Applications & infrastructure
- Web applications
- Mobile applications
- APIs
- Backend services
- AWS / GCP / Azure
- Kubernetes & containers
- CI/CD pipelines
- Identity & SSO
- Internal networks
SECURITY REVIEWS
Seven reviews. The hard part is knowing which one your system needs.
Each targets a different layer of the system. Find yours below, or tell us the scope and a principal will point you to the right review.
Review targets
What do you need reviewed?
Find your system below, and the review that covers it. If your scope crosses categories, we combine the right specialists into one engagement.
Blockchain & smart contract systems
- Solidity
- Rust
- Move
- EVM chains
- Solana
- NEAR
- Substrate
- Bridges
- Trading infrastructure
- Oracles
- Indexers & relayers
- On-chain / off-chain boundaries
Cryptography & privacy systems
- ZK circuits
- Proof systems
- Custom primitives
- Signature schemes
- Threshold signatures
- MPC
- zkTLS
- Privacy protocols
- Post-quantum cryptography
- Hybrid PQC migrations
- Randomness & transcripts
- Implementation & composition
Custody & key management
- MPC
- Multisig
- HSMs
- Custody vendors
- Wallet infrastructure
- Signer infrastructure
- Approval workflows
- Recovery workflows
- Break-glass access
- Treasury operations
- Transaction authorization
AI & automation workflows
- LLM applications
- Agent workflows
- Tool permissions
- Prompt boundaries
- Data exposure
- Model integrations
- Operational automation
- Customer workflows
Timing
When to bring Guvenkaya in
During design
Challenge trust assumptions before they become expensive to reverse.
Before launch
Review the system once its behavior and critical paths are stable enough to test.
Before a major change
Reassess upgrades, migrations, new integrations, custody, or infrastructure changes.
After an incident or concern
Reconstruct failure paths and determine what must change before confidence is restored.
Process
From the right review target to a decision-ready result.
- 01
Choose the review target
Identify the system, workflow, or change that needs independent security judgment.
- 02
Set the boundaries
Confirm the assets, trust boundaries, critical paths, evidence, exclusions, and decision the work must support.
- 03
Run the right review
Match the target to reviewers with the relevant code, protocol, cryptography, infrastructure, custody, or AI expertise.
- 04
Resolve and decide
Work through findings, verify agreed fixes, and deliver the technical or executive readout.
Typical engagement team
Who typically leads this work
The exact team depends on the scope. Every engagement has a principal who owns it from scoping through delivery, joined by the specialists the system calls for, and whoever is assigned is named in your proposal.
Timur Güvenkaya
Founder & Partner
Led a security engineering practice for Rust and non-EVM systems across Substrate and NEAR. Earlier, built vulnerability-detection engines at Invicti used by Fortune 50 and public-sector organizations.
Piotr Cielas
Principal Advisor
Head of Security at Agora, responsible for security, data protection, and corporate IT risk. Earlier at EY, led assessments across financial services, healthcare, and government.
Currently
Head of Security, Agora
$45B+ in volume
Łukasz Mikuła
Specialist Advisor
Offensive security specialist with 10+ years, 100+ public audits across eight ecosystems, and OSCP, OSCE, eWPT, and eWPTX certifications. At ING and Binance, worked across red teaming, exploit development, infrastructure, and high-scale digital asset systems.
Inspectable proof
Relevant public work
Each card shows one highlighted finding, not the full result. Open the report for every finding and its severity.
Protocol Public report
NEAR / Defuse Labs
NEAR Intents Security Review
Selected public finding Medium
Potential Funds Stealing From Users Via Repeating Failed Intents
- NEAR
- Intents
- Protocol
Web application Public report
Sailor Lend
Web Application Security Review
Selected public finding Critical
Vulnerable to React2Shell
- Web
- Application
- Security review
Substrate pallet Public report
Virto Network
Pallet Pass Security Review
Selected public finding High
DoS of The Main Functionality Through Session Key Hijacking
- Polkadot
- Substrate pallet
- Rust
Smart contract Public report
Spin Finance
Onchain Orderbook and Perpetual Trading Security Review
Selected public finding Critical
Order Placement with Negative/Zero Margin Ratio Is Possible
- NEAR
- Smart contract
- Rust
Related services
Secure Architecture & Process DesignDesign or challenge critical systems, workflows, integrations, and operating controls before implementation or major change.Risk AssessmentGive leadership a prioritized view of where security risk concentrates and what to address first.Training & Security ExercisesReady modules on Rust, Substrate, and NEAR, or workshops, tabletops, and key-ceremony rehearsals built around your own systems.
Next step
Put the system in front of the right reviewers.
Share the target, architecture, repo, timeline, and the decision you need the review to support.
Discuss your scope