01
Unauthenticated local APIs
Debug bridges, control endpoints and "convenience" APIs that answer without asking who you are.
Independent security research
Connected devices ship with doors nobody checked.
Routers, TVs, cameras, printers, appliances. They're built to just work — and the shortcuts that make them work are almost never audited. We find those shortcuts, prove they're real on your hardware, and hand you a fix.
Authorised testing only · Read-only by default · Nothing inbound, ever
The problem
Convenience ships. Security gets deferred.
Shipping a device is a race. The feature that makes it friendly — the local API, the debug bridge, the auto-discovery, the update endpoint, the companion app — gets built to work, not to be safe. It's designed-in convenience that nobody hardened.
Years later it's still there: still reachable, still undocumented, still nobody's job. The big scanners don't cover it. Consumer and IoT devices are a long tail of one-off models with no standard to test against, no tidy CVE, and no one looking.
That's the gap we work in. One device at a time, proven on the hardware in front of us.
How it works
Find, prove, fix, verify.
-
Find
We map the device the way an attacker would — services, credentials, firmware, the undocumented routes. Passive discovery first, then a light active pass. We never touch what we don't need to.
-
Prove
A finding only counts if it's reproducible. Every issue gets a live demonstration on hardware you own, with the exact steps and raw output on the record. If we can't prove it, we don't claim it.
-
Fix
A designed fix you can actually apply: what to change, where, and how. Where the vendor won't act, network-level controls close the door anyway.
-
Verify
We re-run the same test and it has to fail to reproduce. A fix without a re-test is just a claim. Then we keep watching, so you know when something moves.
What we cover
Seven classes of problem, in any device.
02
Exposed admin panels & default credentials
Printers, cameras, routers and appliances serving an admin page — often still on the default login.
03
Protocols with no auth
MQTT, RTSP, DLNA/UPnP, telnet: fine by design, wide open by default.
04
Update & recovery paths
Is the update signed? Is the recovery path writable? Can config be replaced by anyone on the LAN?
05
Cloud & telemetry egress
What the device phones home with, and to whom — the part nobody reads.
06
Companion app & pairing
The trust model between app and device: the certificates, the tokens, the pairing that authenticates nothing.
07
Firmware hygiene
Ancient components, stale certificate authorities, permissive builds. The things that age badly in a drawer.
Who it's for
Homes and small business.
Your home
The router, the TV, the cameras, the printer in the study. You don't need a security team — you need someone to actually look, prove what they find, and fix it. That's the whole job.
Your small business
Clinics, studios, cafés, workshops, small offices. A handful of devices, no dedicated IT, and a network that genuinely matters. Same loop, scaled to you — without an enterprise bill.
How we work
Testing happens on assets you own, with written authorisation, in stages — read-only first, reversible always. Nothing is exposed inbound; the probe dials out. We don't change anything until we've agreed exactly what will change and how to undo it.
Pricing
Coming soonPlans are being finalised.
We're still setting prices, so we're not going to pretend otherwise. What we can tell you now: an assessment is a flat fee agreed up front, and ongoing coverage is a subscription that re-tests and watches on a schedule. No seat-counting, no surprise invoices.
Plans will be listed here when they're ready. Until then, tell us what you're looking at and we'll give you a straight answer on scope and cost.
The console
Auto, with the checks and balances to match.
Everything runs from the console at app.hello-clarence.com: your sites and devices, the schedule and its advance notice, every finding with its evidence and fix, and a cancel button that works right up until a run starts.
Runs are automatic once you're set up — but only against a signed agreement, inside an agreed window, and never outside the test classes you permitted.
Contact
Tell us what you're worried about.
A specific device, a room full of them, or the whole office — send us a line and we'll say plainly whether it's something we can help with.