We secure the open source the world runs on.
From cryptography and web servers to compilers, codecs and data engines — we find and fix vulnerabilities deep in the software supply chain, then upstream the fixes so everyone is safer. Real patches, merged into the projects the world depends on.
Security work, upstreamed
We don't just file reports — we ship the fix into the project, peer-reviewed and merged by maintainers.
Vulnerability discovery
Memory-safety bugs, parsing flaws, overflows and undefined behaviour in security-critical C/C++ code — found, triaged and reproduced.
Fuzzing & harnesses
Continuous fuzzing and new test harnesses — including work alongside Google's OSS-Fuzz — to surface defects before attackers do.
Upstream patches
Production-grade fixes submitted as pull requests and merged by maintainers — the fix lives in the project, not in a PDF.
Supply-chain hardening
Securing the dependencies your stack is built on — codecs, compression, crypto, networking and parsers used by millions.
Performance & correctness
Hardening that also makes code faster and more correct — patches across data engines, JSON parsers and image libraries.
Good open-source citizens
We work the way maintainers expect — clear reproducers, focused diffs, responsive review — building long-term trust upstream.
Where it matters most
A selection of the foundational, security-sensitive projects our team has contributed fixes to.
Projects we've improved
A sample of the major open-source projects our contributors have merged work into. Every chip links to the live repository.
…and 90+ more repositories across the ecosystem.
Deep where it's hardest
Our work concentrates in low-level, security-critical C and C++ — the code most languages and applications quietly depend on.
Figures above are a verified sample audited live from a representative subset of our public contributor accounts: 737 pull requests · 306 merged · 129 repositories · ~1.8M combined stars. Program totals reflect 20+ contributor accounts.
Harden what you depend on.
Need a dependency audited, a project fuzzed, or vulnerabilities found and fixed upstream? Let's talk.
Want your own private code reviewed instead? That's our Secure Code Review practice.