Security engineering & assurance

Security for the systems that move money.

We test, audit and defend financial infrastructure — exchanges, trading platforms, custody flows, smart contracts and the cloud they run on.

Offensive testing, on-chain and custody review, incident response and audit readiness, delivered by engineers who have built the systems being assessed.

Services

Four practices. Engagements are usually drawn from more than one — a contract review that reaches into custody, or a penetration test that ends in audit evidence.

01

Offensive security

Penetration testing

Grey- and black-box assessment of web applications, APIs, internal networks and trading interfaces. Business-logic led, not scanner output.

  • web & api
  • network
  • authn/authz
  • business logic
  • retest included

Red team & adversary simulation

Objective-based, assumed-breach exercises against your real detection and response. Scoped to an outcome — reach the signing infrastructure, move funds, exfiltrate the customer table — rather than a vulnerability list.

  • assumed breach
  • objective-based
  • detection testing
  • purple team debrief

Secure code review

Manual source review of backend services and trading logic in .NET, Node, Java, Rust and Python — concurrency, state machines, money handling and trust boundaries.

  • .net
  • node/ts
  • java
  • rust
  • python
  • race conditions

Smart contract review

Solidity and EVM review with executable invariants. Every finding ships with a proof of concept that fails before the fix and passes after it.

  • solidity
  • invariant fuzzing
  • foundry
  • vesting & token sale
  • defi accounting
02

Platform & cloud

Wallet & custody review

Assessment of key management and signing paths end to end — HSM and MPC configuration, quorum and policy design, key ceremony procedure, withdrawal approval flows, and the integration code around third-party custodians.

  • mpc
  • hsm
  • signing policy
  • key ceremony
  • withdrawal controls
  • custodian integration

Cloud security assessment

AWS and GCP configuration review — IAM and privilege-escalation paths, network exposure, secrets handling, logging coverage, container and workload posture.

  • iam & privesc
  • network exposure
  • secrets
  • containers
  • cis benchmarks

DevSecOps & supply chain

Pipeline and dependency risk: CI/CD privilege and artefact integrity, secrets in build systems, infrastructure-as-code review, base image and dependency exposure, SBOM and signing.

  • ci/cd hardening
  • terraform / iac
  • sbom
  • dependency risk
  • artifact signing

Threat modelling & architecture review

Design-stage review before code exists — trust boundaries, failure modes and the invariants the system must hold. The cheapest point at which to fix an architecture.

  • trust boundaries
  • invariant design
  • failure modes
  • pre-build
03

Detect & respond

Deception & detection engineering

Honeypots, canary tokens and tripwires placed where a real intruder would step, wired into alerting you actually read. High-signal detection without another dashboard.

  • honeypots
  • canary tokens
  • alert tuning
  • mitre att&ck

Incident investigation

Response and forensics when something has already happened. Timeline reconstruction from logs and on-chain data, scope of compromise, containment, and a root-cause write-up that survives scrutiny.

  • dfir
  • timeline analysis
  • on-chain tracing
  • containment
  • post-mortem

IR readiness & tabletop

Runbooks, escalation paths and decision authority agreed before you need them, then exercised against a realistic scenario. Most incidents go badly because nobody knew who could halt withdrawals.

  • runbooks
  • tabletop exercise
  • escalation design
  • kill-switch drill
04

Assurance & governance

IT audit & general controls

ITGC review across access management, change control, segregation of duties and operational monitoring — with the evidence an auditor will actually accept.

  • itgc
  • access reviews
  • change control
  • segregation of duties

ISO 27001 & SOC 2 readiness

Control design, gap analysis and evidence preparation. We prepare you for the audit and sit with you through it. Certification and attestation are issued by accredited bodies — not by us.

  • iso 27001
  • soc 2
  • gap analysis
  • evidence
  • policy review

vCISO & programme leadership

Fractional security leadership on retainer: roadmap, risk register, vendor and third-party review, board reporting, and ownership of the programme between audits.

  • retainer
  • risk register
  • roadmap
  • vendor risk
  • board reporting

Bug bounty programme design & triage

We stand up your programme and run the inbound: scope and policy drafting, safe-harbour terms, severity and reward tables, then day-to-day triage — reproducing submissions, de-duplicating, rejecting noise, and handing your engineers only what is real, with a proof of concept attached.

  • scope & policy
  • safe harbour
  • reward tables
  • triage & dedupe
  • researcher comms

Where we're different

We build exchanges. That's why we find the bugs others miss.

The highest-severity defects in trading and financial systems are rarely injection or memory safety. They are broken invariants in code that reviews cleanly: a cancel path that refunds the original locked amount instead of the remaining one, a balance check that two concurrent orders both pass, a maker rebate that exceeds the taker fee, a cliff boundary off by one second.

Finding those requires knowing how matching engines, order lifecycles, settlement and custody are actually implemented — not a checklist.

Sector experience: centralised and decentralised exchanges, brokerage and copy-trading platforms, high-frequency trading infrastructure, token sales and tokenisation, payments and ERP.

Who you're working with

Prasanta Sahoo

Principal

Builds and operates the systems this practice assesses. Work spans exchange and trading infrastructure — matching engines, order management, ledger and settlement — and the security and compliance programmes around them.

Engineering work spans centralised exchange infrastructure — matching engine, order management, ledger and settlement — across a large microservice estate; institutional FX market-making systems in Rust, including FIX and ITCH protocol handling and colocated execution; custody integration over MPC and HSM-backed signing with major third-party providers; token issuance and vesting contracts; brokerage and copy-trading platforms; and an ISO 27001 programme across a multi-service production estate.

Client names are withheld. References can be provided under NDA for qualified engagements.

How an engagement runs

  1. Scope and rules of engagementWritten scope, testing windows, escalation contacts and data-handling terms agreed before anything is touched. Nothing outside the agreed boundary is tested.
  2. Threat modelWe write down what your system claims to guarantee. Those claims become the invariants we try to break — the assessment is driven by your design, not a generic checklist.
  3. TestingManual, hypothesis-led work supported by fuzzing and automation. Critical findings are reported the moment they are confirmed, not held back for the report.
  4. ReportingEvery finding carries reproduction steps, a proof of concept, impact in your terms and a concrete fix. Written to be handed straight to the engineer who owns the code.
  5. RetestWe verify the fixes and confirm they are complete rather than mitigating. Included in fixed-scope engagements.

Frameworks we work to

Assessments map to recognised methodology, so findings are defensible to your auditors, your board and your customers.

OWASP ASVSOWASP WSTG OWASP API Top 10PTES NIST CSFNIST SP 800-115 ISO/IEC 27001SOC 2 CIS BenchmarksMITRE ATT&CK CCSSSCSVS

We deliver readiness, control design and evidence for ISO 27001 and SOC 2. Certification and attestation are issued by accredited bodies and auditors, not by us.

Engagement models

fixed scope
A defined assessment with a report and retest.Penetration test, contract review, custody review, cloud assessment, audit readiness.
retainer
Continuous review across releases, or fractional leadership, with agreed response times.Suits teams shipping to production regularly, and vCISO engagements.
incident response
Engaged during or immediately after an incident.Containment first, forensics and root cause after.
advisory
Design review and threat modelling before code is written.The cheapest point at which to fix an architecture.

Contact

enquiries
research@deebug.io
disclosure
security@deebug.ioReporting a vulnerability in our own systems — see security.txt.
pgp
public keyPlease encrypt anything above medium severity.
nda
Signed on request, before scoping.
data handling
Client data is held only as long as an engagement requires, then destroyed on request.Findings and evidence are encrypted at rest and never shared with third parties.

Testing is carried out only under written authorisation, within agreed scope. We do not accept work against systems a client does not own or control.