Independent security research for multi-tenant SaaS.

03

“Nick from GreySurface identified and documented two real vulnerabilities in our Cognito configuration, including a silent account takeover chain. The report was technically accurate, the disclosure was handled responsibly, and the fixes were live in production the same day. If you manage a B2B product and receive a report from him, I'd recommend taking it seriously.”

04

“The report was thorough, well-documented with reproduction steps, and clearly written with the intent to help. We'd have no hesitation recommending Nick.”

05

“Nick reported it to me professionally, providing enough information to identify and resolve the matter within a few hours. I recommend his professionalism and expertise.”

06

“Nick provided a professional review of our platform's security. He was thorough but respectful and provided a detailed report of his findings. We will definitely be using his services in the future.”

07

“GreySurface was very kind to perform a security audit on Pulso and submit a professional report. Thanks to them our platform is more secure.”

08

“GreySurface responsibly reported a security issue to PropReady, communicated it clearly, and helped us validate the fix.”

09

“The findings were well-structured, clearly written and easy to reproduce and verify.”

10

“Your report demonstrated a high level of professionalism and ethical conduct. Your actions directly assist us in our ongoing efforts to enhance our security posture.”

11

“Nick (GreySurface) reported a security issue to us through responsible disclosure. His communication was clear and professional throughout the process. I'd recommend him to anyone handling a similar report.”

12

“Your write-up was thorough, professional, and clearly in good faith. The responsible disclosure approach was exactly the right way to handle this.”

13

“The reproduction steps, timestamps, CVSS scoring, and cleanup list made it genuinely easy for our team to triage and validate quickly.”

14

“I really appreciate the time, care, and clarity you put into this write-up. The clean reproductions made it easy to act on quickly.”

15

“I appreciate the care you took: registering your own accounts, pulling only enough to confirm the issue, and writing it up clearly.”

16

“Nick's report was clear, well scoped and responsibly handled. The control tests saved us time confirming scope and helped us validate the fixes.”

17

“We appreciate your responsible disclosure and the professionalism you demonstrated throughout this process. Your commitment to improving security, combined with the clarity of your report, enabled our team to assess and mitigate the issue. We value the time and effort you invested in reporting the issue”

18

“Nick reported a security issue to us privately, handled the disclosure responsibly and professionally throughout, and was straightforward to deal with in resolving the matter.”

19

“Nick at GreySurface responsibly disclosed a vulnerability within our authentication flow. His initial report was clear, professional, and highly actionable, and he was highly respectful of our systems and boundaries throughout the process. I appreciate his ethical approach to security research and his help in keeping CertNudge secure.”

20

“GreySurface submitted a clear, well-documented responsible-disclosure report regarding a reflected input-handling issue in a public-facing form on our platform (a SaaS practice-management platform for service businesses). The report included precise reproduction steps, impact assessment, and suggested remediation, and testing was scoped responsibly to the reporter's own test account throughout. Following our fix, GreySurface independently validated the remediation and confirmed it was effective. We'd recommend GreySurface for careful, professional security research and responsible disclosure.”

21

“Roomnix ekibi bildirilen bulguyu hızlı ve yapıcı bir şekilde ele alıp düzeltmeyi kısa sürede yayına aldı.”

22

“Nick from GreySurface approached us unprompted, looked for a way to report responsibly before he tested anything, and worked only against dummy records he created himself. His write-up was clear and well structured, and every finding came with steps we could follow straight away, so we were able to close them quickly. Security research handled to that standard is genuinely valuable, and we are grateful for it.”

23

“Hemos recibido un informe relativo a seguridad por parte de Nick de uno de nuestros productos que ya estaban en du fase final de vida. Sinceramente el trabajo es más de lo que hubiese esperado, porque además de incluir los posibles fallos de seguridad, incorporaba información acerca del proceso para explotar la vulnerabilidad junto con ideas para solucionarla. Todo ello a un nivel de detalle más que profundo, incluyendo ejemplos de llamadas, nombres de variables, etc. Volveremos a contar con la ayuda de Nick para nuestra próxima herramienta.”

24

“Yours was precise, scoped. That made this easy to take seriously.”

25

“C'est exactement le niveau de rigueur qui rend un rapport actionnable rapidement.”

26

“Nick’s work with GreySurface was extremely helpful to Roanex. His responsible and thoughtful approach helped us identify areas where we could further strengthen our security and make the platform even more secure. He communicated everything clearly and professionally throughout the process, and I genuinely appreciate the time and effort he put into helping us improve.”

27

“GreySurface (Nick) responsibly disclosed a security finding to MyPetSitter and handled the entire process professionally from start to finish. The report was clear, well documented and responsibly disclosed, with all testing remaining within the agreed scope and limited to controlled trial accounts. Throughout the process, communication was professional, constructive and collaborative. We'd happily recommend GreySurface to organisations looking for responsible security research and vulnerability disclosure services.”

28

“Nick from GreySurface flagged several security issues to us in a clear and responsible way, laying them out with enough detail for us to fix them quickly. He was professional and easy to work with, and I would gladly recommend him.”

29

“Le rapport était clair, reproductible et directement actionnable : chaque faille était accompagnée de la cause racine localisée à l'endpoint près, des contrôles négatifs et positifs, et d'un correctif concret. Nos équipes ont pu passer à la correction sans phase d'interprétation. Les effets de bord ont été déclarés spontanément, ce qui a facilité notre analyse.”

30

“GreySurface nous a signalé une vulnérabilité de sécurité sur la plateforme Kobli de manière responsable et coordonnée. Le rapport était clair, documenté et accompagné d'une preuve de concept reproductible, ce qui nous a permis de comprendre et de corriger le problème rapidement. Les échanges ont été professionnels, transparents et menés de bonne foi tout au long de la divulgation. Nous recommandons GreySurface pour le sérieux et la qualité de son travail.”

31

“KyoOS thanks GreySurface for responsibly disclosing a security issue prior to launch, and for working with us through a swift resolution.”

32

“We would like to thank Greysurface for disclosing a security vulnerability identified in 2026. The analysis was conducted with due respect for our infrastructure. The report was clear, well documented, and accompanied by relevant recommendations.”

33

“GreySurface reported a security issue responsibly and provided a clear, detailed report that helped us investigate and address the issue quickly.”

34

“Bezpečnostní report od GreySurface byl velmi užitečný. Jasně strukturovaný s důrazem na to, co je skutečně důležité, takže jsme mohli rychle reagovat.”

35

“Nick (GreySurface) reported a column-level access control flaw in our database. The report was precise, reproducible, and included control tests that let us scope the problem in minutes rather than a day. His suggestion to extend the review to adjacent tables led us to close a second path with greater impact than the first. His testing stayed on accounts he created himself and touched no customer data, which our own audit confirmed. We were not in a position to pay for the work and he accepted that without argument. For a small team, this is the kind of report you want to receive.”