Security and authorisation

How Verdict Runtime keeps testing safe: nothing runs without your written scope, and the method is held to the standard it sells.

Authorisation

Nothing runs without your written scope

Every agent that can send traffic checks the target against a scope file your team signs off. The check is compiled in, not a setting. No entry, no run.

  • ›
    Reading source needs only a repository entry.
  • ›
    Live traffic and logged-in testing each need their own explicit grant.
  • ›
    Anything that writes data needs a separate disposable-target attestation.
.pentest-scope
# reviewed and committed by your team
https://github.com/acme/api
dynamic:https://staging.acme.com
credentialed:https://staging.acme.com
# production is deliberately absent
Why trust the method

Held to the standard it sells

We test this tool by fixing real security bugs in open-source projects that owe us nothing and review the work in public.

9
pull requests patching real CVEs in active open-source projects
2
accepted by maintainers: one merged, one shipped by the maintainer within minutes
50+
production open-source projects used to validate new detections
2
detection rules submitted to community rule sets, still in review

Known gaps are documented, and nothing is described as validated unless the validation was actually run.

Get your first verdict free

One repository, one report, no obligation: the findings, the evidence behind each one, the fixes we can prepare, and an honest note on what we couldn't check.

Request a free assessment See a sample report Reply within two business days.
We never scan first. Nothing is tested until you've named the target in writing and confirmed you're authorised to have it tested.