Find out how someone would get in, before they do.

Security reviews for the SaaS you buy, run, and build, and authorized penetration testing when you need proof. Led by Tymofiy Rabchuk, OSCP and GIAC GXPN, with eight years in offensive security for Fortune 500 clients.

Scope a review Book a 20-minute call
Finding 04 of 11High

A meeting-notes app can read every file in your Google Drive

Found in
Google Workspace configuration review
Path
  1. One employee approves a third-party notes app.
  2. Workspace allows any app to request full Drive access.
  3. The app can read every folder shared with that employee, including finance.
Fix
Allow only reviewed apps, then revoke this grant.
Effort
About 30 minutes
An illustrative finding, in the format our reports use.

Review or test

Most teams start with a review. When you need proof, a penetration test shows what an attacker can actually reach.

Security reviewRead-only, low disruption
Penetration testProof, under signed scope
Covers
The SaaS you buy (vendor reviews), run (Workspace, Microsoft 365, Slack, GitHub settings) and build (auth, tenant isolation, secrets, AI features).
Web apps and APIs, cloud and SaaS tenants, external and internal networks, AI and LLM features, and social engineering: phishing, phone, and SMS campaigns.
Access
Read-only access and documents. Nothing is attacked.
Active testing, only inside a signed scope and test window.
Best when
Before you buy a tool, after you have outgrown its defaults, or before you launch.
You need proof an attacker can't get in, for customers, auditors, or yourself.
You get
Written risks and fixes in priority order.
Attack paths, evidence, fixes in priority order, and a retest.

Testing is run by Tymeless Product Security, our offensive-testing function. It tests Tymeless's own products and takes contract engagements for clients. We can also help you answer your customers' security questionnaires.

How an engagement runs

Nothing starts until scope is in writing.

  1. Agree the scope

    A written scope, test window, and NDA, signed by the system owner and the security lead.

  2. Review or test

    Reviews stay read-only. Tests stay inside the signed scope and window. Critical findings reach you the same day.

  3. Report and fix

    Risks, evidence, and fixes in priority order, then a walkthrough with your team and a recheck once fixes land.

Tymofiy (Tym) Rabchuk

Founder and security lead, Tymeless Technologies

OSCPOffensive Security Certified Professional
GXPNGIAC Exploit Researcher and Advanced Penetration Tester
  1. 2025–2026

    Practice Manager at Praetorian

    Ran delivery of penetration testing, application, cloud, and AI security assessments for Fortune 500 clients. Led about ten security engineers.

  2. 2018–2025

    Attack and Penetration Testing at Protiviti

    Consultant to senior manager. Red and purple team exercises, external and internal penetration tests, detection engineering, and social-engineering campaigns.

  3. Education

    BBA, Management Information Systems at Temple University

    Open-source work at github.com/5uck1ess.

Tell me what you're buying, running, or shipping.

I'll tell you straight what's worth reviewing, and what isn't.

Scope a review [email protected]