Clickswave Labs is a research-led cybersecurity company. We make Crossfyre for offensive security and SiloCat for end-to-end encrypted file sharing, and we take on security testing directly.
Distributed recon and offensive-security automation.
End-to-end encrypted file storage and sharing.
Hands-on security work on your apps and APIs, usually the part standard tooling cannot reach. Client work is under NDA, so there are no names on this page.
Most mobile testing stops at the apps that refuse to be intercepted. Pinned builds, Flutter, root and tamper detection: those get tested too.
The findings are in the API behind the app: authorization gaps, another user's data, and fields the app sends that it never needed to send.
Logged-in testing across the whole API surface, not only what is reachable from outside. Most of what comes back is authorization: one account reaching another account's data, with the request that proves it.
Read access to the repository, and every finding comes back with the file and line behind it. It reaches what testing a running system cannot: paths behind a flag, a check that was never written, and credentials committed years ago.
A read of the protections you already have and where they actually sit. A check in the wrong place passes review and stops nothing, and that is the common finding rather than a missing one.
Crossfyre has a research wing. It works out new ways to test things, and it finds bugs in software other people maintain. Both end up in the product.
Ways to test what nothing could test before. Reading the TLS verifier out of a stripped Flutter binary started here, and it runs on every job now.
Found in software we don't own and sent to the maintainer first. The disclosures page carries a count until they publish, then the whole write-up.
Security software you can't inspect is security software you have to trust blindly. We'd rather show you the code.
The entire product: backend, frontend, encryption. Read it, run it, self-host it.
The engines that run scans: mach, voyage, pulse, and the node agent. The platform is commercial; the tools are yours.
Product questions start at crossfyre.io or silo.cat. For everything else, write to us.
