Explicit scope and authorization
Agree the applications, accounts, repositories, environments, testing methods and permitted changes before access is granted. Scope extensions require agreement.
Trust and delivery boundaries
Know how the work will run.
Before you grant access.
Security work needs a clear boundary. The engagement defines the systems, people, data, approvals and evidence involved, so your team can review the arrangement before work begins.
What to agree together
A working relationship
with visible boundaries.
These principles guide engagement planning. Customer-specific commitments are recorded in the agreed scope and delivery terms.
Least-privilege access
Choose named, customer-controlled and limited access appropriate to the work. Agree credential delivery, access expiry and revocation during onboarding.
Agreed data handling
Define where tools run, what source or evidence may leave the environment, approved providers, retention, report transfer and deletion expectations.
Reviewable changes
Use agreed review and release workflows for code, policies and configuration. Identify the change owner, approval path, production window and recovery steps.
Evidence with honest limits
Record the tested version, scope and relevant conditions. Keep failed, partial, missing and not-tested checks distinct from passing results.
Clear collaborators and handover
Agree any additional specialists and their access before involving them. Keep responsibility, communications, deliverable ownership and end-of-engagement handover explicit.
Technical evidence, accurately described
Make it clear what
the evidence establishes.
A passing check answers a defined question under tested conditions. Reports identify scope, limitations and remaining risks.
- Review findings before treating them as confirmed vulnerabilities.
- Separate a proposed fix, a merged change and a verified deployed correction.
- Keep risk acceptance with the named customer authority.
- Agree recurring coverage and response terms explicitly.
Technical evidence is not certification, a legal opinion or a guarantee that every vulnerability has been found.
Report a security concern
Contact a person.
Send the affected WEFT surface, reproduction steps and observed impact to jawad@weftsecurity.com. Use a minimal proof and avoid sending credentials, unrelated personal data or destructive test results.
For client systems, use the reporting and authorization route agreed with that system’s owner.
Read the privacy policyExpertise without a full-time hire
Bring your architecture and access requirements.
Tell us about your product, what needs attention and any deadline. We’ll agree a useful starting scope and the right level of support.