Subgraph

What we do.

The people who test your systems also write exploits and build Subgraph OS. We check each finding by hand before it goes in the report, and we include the steps to reproduce it.

Security Code Review

We read your source code for vulnerabilities, from application logic down to kernel code and C.

  • Manual review by experienced auditors
  • Static analysis and vulnerability scanning
  • Logic flaw identification
  • Secure coding practice recommendations
  • Developer training and remediation guidance

Architecture Review

We review how your system is designed: what each part trusts and where the boundaries are. This works best before the code is written.

  • Security architecture assessment
  • Threat-modeling workshops
  • Trust boundary analysis
  • Defense-in-depth evaluation
  • Design-pattern security review
  • Compliance and regulatory alignment

Application Penetration Testing

We test your web, mobile and desktop applications by hand, with a focus on flaws that automated scanners do not find.

  • Web application security testing
  • API, microservice, and web service testing
  • Mobile application testing (iOS/Android)
  • Desktop application testing
  • Authentication and authorization testing
  • Business logic vulnerability discovery

Network Penetration Testing

We test your external and internal networks, and check whether your network segmentation stops an attacker who is already inside.

  • External perimeter testing
  • Internal network assessment
  • Wireless security testing
  • Network device configuration review
  • Segmentation and isolation testing
  • Social attack simulations

Specialties.

Web Application Testing

Modern web frameworks, SPAs, APIs, and complex client-server architectures.

Low-Level Code Review

C/C++, memory safety, kernel code, embedded systems, and systems programming.

Cryptographic Review

Protocol design, implementation review, key management, and cryptographic primitives.

Reverse Analysis

Binary and malware analysis, undocumented protocols, defeating obfuscation.

AI & Agentic Systems

Prompt injection, agent permissions, model supply chain and data leakage to hosted inference.

Privacy Technologies

Anonymous communication, metadata protection, privacy-enhancing technologies.

Experience.

OTF Security Lab

Subgraph is an approved supplier of penetration testing and audit services to the Open Technology Fund Security Lab. We have audited tools used by journalists, activists and human rights defenders around the world. We also created Vega, an open-source web application scanner used by tens of thousands of people.

Learn more about OTF Security Lab →

10+ Years of
vulnerability research
OTF Security Lab
approved supplier
Vega Open-source scanner
we created

Published audits.

Reports our clients have made public.

Tella

Security assessment of Tella, a mobile documentation app for human rights defenders working in hostile environments. We reviewed the app's architecture and implementation.

View Report (PDF) →

NetAidKit

Security audit of NetAidKit, a portable network security tool. Analysis covered the system architecture, network isolation mechanisms, and security configuration.

View Report (PDF) →

FileZilla

Penetration test and code review of FileZilla, the widely used FTP client.

View Report (PDF) →

Who We Serve

Privacy & Human Rights

NGOs, activist organizations, and developers of privacy-enhancing technologies. The people who use these tools can be arrested or hurt if the tools fail.

Financial Technology

Fintech platforms, cryptocurrency projects and payment systems.

Enterprise Software

SaaS platforms and business applications.

Open Source Projects

Security-critical open source software, infrastructure tools, and developer platforms.

Contact.

Send us a short description of the system and what you want tested. We will reply with a proposed scope and an estimate.

Email us