Learn

What the standards actually say.

Compliance guidance is mostly written by people selling the checkbox. These pages quote the control text verbatim, publish the real price bands, and give the honest answer even when it costs us the pitch.

SOC 2

• 01 Does SOC 2 require a penetration test? → No criterion mandates one. What the AICPA actually says, why auditors expect a test anyway, real 2026 price bands, and the observation-window timing rule.

Penetration testing

• 02 How much does penetration testing cost? → $5,000 to $30,000 for a web app, and under $4,000 is a scan. The 2026 bands by engagement type, the day-rate math behind every quote, and our public price list.

PCI DSS

• 03 PCI DSS penetration testing requirements → The framework that mandates a pentest in normative text. Requirement 11.4 clause by clause, the retest everyone forgets to price, and why it does not need a QSA.

Security research

• 04 A critical RCE we found in velocity.js → CVSS 9.8, GHSA-7gfh-x38p-prh3, fixed in 2.1.7. The property-read chain to the Function constructor, why the prior prototype-pollution patch missed it, and how to fix it.
• 05 A disabled key-size check we reported in Tor's arti → A misplaced ! disabled an RSA key-size check in Tor's arti. How if !x == y compiles in Rust, why it slipped past clippy and the tests, and the one-line fix Tor merged.
• 06 The Function constructor escapes safe eval in JSONPath-Plus → A property read returned the Function constructor in a library pulled 12M times a week, so obj.constructor gave RCE. The guard gap, the one-clause fix, and the CVE chain.
• 07 A cookie-leak bug we reported in tough-cookie → A URL-parsing differential leaked victim.com cookies to attacker hosts, in a library pulled 480M times a month. The decodeURI root cause, the fix, and a note on crediting researchers.