Skip to main content
Offensive Security Researchers · Est. 2025

We Find What Your

SDX Shadow Labs runs white-box codebase audits, black-box penetration tests (VAPT), and custom secure architecture engagements for growth-stage startups and mid-level enterprises in India and globally. We treat security as an engineering problem, not a checkbox.

View Public Disclosures
2M+Users Secured
Protected across research disclosures & client audits
9Public Advisories
Coordinated responsible research disclosures
7M+Records Protected
Exposed databases & leaking infrastructure secured
100%Manual Verification
Human-led research · Zero AI false positives
Scroll

Protecting teams across

// What we secure

Four disciplines, each run as a complete engagement.

You get an operator's report, not a tool export. Every finding comes with exploit evidence and a verified fix path.

White-BoxBlack-Box

Codebase Auditing & Penetration Testing

We read your source code before we attack your perimeter. Our operators combine deep white-box codebase analysis with live black-box exploitation chains - discovering the business logic flaws, race conditions, and authentication boundaries that no automated scanner will ever model. Every finding is delivered as a working, reproducible Proof-of-Concept, never a theoretical flag.

Explore Service
ISO 27001SOC 2

Security Auditing & Compliance

A gap analysis that tells you exactly where your controls fail - measured against ISO 27001, SOC 2 Type II, OWASP ASVS, and India's DPDP Act. We map your real infrastructure against each framework control, surface the specific gaps, and deliver a prioritized remediation roadmap your engineering team can actually execute - not a 200-page PDF of generic recommendations.

Explore Service
Zero TrustAWS

Secure Architecture Design

Security is hardest to retrofit. Our architects run STRIDE and LINDDUN threat modeling workshops on your planned or existing infrastructure, design Zero Trust identity and access layers, and produce a hardened reference architecture across AWS, Azure, and GCP - before the vulnerabilities are written into your codebase.

Explore Service
DevSecOpsTraining

Secure SDLC & Developer Training

The most cost-effective vulnerability is the one never written. We embed security into your engineering process - integrating SAST, DAST, and SCA tooling directly into your CI/CD pipelines, running hands-on secure coding workshops tuned to your exact tech stack, and performing critical-path manual reviews on authentication flows, payment logic, and permission models.

Explore Service

// Methodology

How every engagement runs

The same rigorous process, every time. No templated playbooks. No recycled output from a previous client.

  • Full attack surface enumeration across all exposed assets - web, mobile, API, cloud infrastructure
  • Technology stack fingerprinting and dependency chain analysis before a single test request is sent
  • STRIDE + LINDDUN threat modeling against your specific architecture - not a generic checklist
  • Out-of-scope boundary definition and engagement charter sign-off before any exploitation begins
Deliverable:Attack Surface MapThreat Model Document
  • White-box codebase audit: authentication boundaries, business logic flows, session handling, dependency risk
  • API schema extraction, endpoint enumeration, and authorization model mapping
  • Automated pipeline run for baseline signal only - every result is manually triaged before it enters the chain
  • AI-generated false positives are explicitly filtered. Nothing enters the report we haven't verified by hand
Deliverable:Verified Finding Candidates Log
  • Manual exploitation of every candidate finding - we build working attacks, not theoretical flags
  • Attack chain construction: chaining individual low-severity findings into critical breach paths
  • Proof-of-Concept development - every Critical and High finding ships with a reproducible payload
  • Optional live exploitation session: client-observed, real-time demonstration of breach impact
Deliverable:Working PoC PayloadsExploitation Evidence
  • CVSS 3.1-scored operator report - findings written by humans, not auto-generated from scanner output
  • Each finding: description, business impact, full PoC payload, and a precise engineering-ready fix path
  • Remediation walkthrough session with your engineering team - we explain every fix, answer every question
  • Free retest on all Critical and High findings - we verify every fix holds before issuing the closure certificate
Deliverable:Final Audit ReportRetest CertificateFix Verification Log

// Research

Public disclosures from the field.

All advisories follow coordinated responsible disclosure. Vendors are notified and given remediation time before public release.

MEDIUMSDX-2026-005

Batch Timeout Race Condition in PeggyJV Gravity Bridge

During independent security research, SDX Shadow Labs discovered a critical race condition in the PeggyJV Gravity Bridge module (GHSA-4vf2-m5pw-3r3r). The vulnerability existed between the Cosmos-side batch timeout cancellations and the Ethereum batch execution events. The flaw caused silent failures during state cleanup, allowing cancelled transactions to be re-batched under new nonces. In specific timing scenarios, this could lead to double-spending on Ethereum while transactions were refunded on Cosmos, threatening bridge solvency.

Read Advisory August 2026
CRITICALSDX-2026-004

Unauthenticated Exposure of Active Security Researcher Infrastructure: RCE, AI API Key Leakage, and Full Operational Intelligence Disclosure

During passive recon research, SDX Shadow Labs discovered a professional security researcher's personal server fully exposed to the internet with zero authentication - running a custom AI-augmented bug bounty operations platform. An embedded terminal provided unauthenticated RCE (CVSS 9.8). AI API keys and unsubmitted zero-day findings were readable without credentials. The server owner could not be identified. This advisory is a public notice published with a redacted dashboard screenshot - if you recognise your own tooling, please secure it and contact us.

Read Advisory August 2026
View All Research Disclosures

// Ethos

Our Security Commitments

How we maintain operational excellence, IP confidentiality, and technical integrity across every engagement.

Zero Code
Exfiltration

Air-gapped security reviews always. We never pipe your proprietary source code, microservices, or database schemas into third-party cloud AI providers. Your IP stays inside your perimeter.

0client codebases ever sent to external AI

Zero AI Hallucinations

No AI false positive noise. Every reported finding is manually validated with reproducible evidence - if we can't prove it, it doesn't ship.

Every reported finding includes reproducible validation evidence.

Business Logic Mastery

AI scanners match syntax tokens. Our researchers break state machines, TOCTOU race conditions, and financial workflow boundaries that no automated scanner can reach.

Actionable Patch Guidance

Developer-focused remediation roadmaps with exact code fixes not generic advice. Complimentary retest included on all Critical & High findings.

Ready to find what your scanners missed?

Schedule a technical discovery call with our principal researchers. Direct engineering feedback, zero sales pitch.