One environment per engagement
Each assessment runs in a clean environment built for it alone. Static analysis runs offline; network probes touch only in-scope targets during the agreed window.
How we handle your systems
The rules we work by. Each one is written into every statement of work.
Access
We see only what the signed scope names, for as long as the engagement runs.
- Configuration and code onlySource code, dependency manifests, certificates, protocol settings and key management configuration. Never databases, mission data or patient records.
- Written authorization firstWe assess only the repositories, hosts, clusters and accounts named in a signed scope.
- Read-only, short-lived credentialsAccess expires with the engagement, and we ask you to revoke it at handover.
- Business associate agreementsWhen work requires access to systems holding protected health information, we sign one first.
- Observation, not interceptionRuntime sensors are deployed only with your change approval, record handshake metadata such as protocol, cipher suite and certificate, and are removed at close. They never capture or decrypt payloads.
Isolation and evidence
Only the report leaves
Your code and configuration stay inside that environment, which is destroyed at close.
A record of every run
A manifest of tools, versions and inputs, with hashes of every output, so results can be reproduced.
Your findings stay yours
We never publish client findings. Published statistics are aggregated, identify no client, and appear only where your contract allows.
How we use AI
Findings come from deterministic tools that give the same answer on every run. AI helps explain findings and draft guidance, an engineer reviews every line, and AI never creates a finding.
For legacy code where scanners are weak, an AI model flags candidate cryptography and an engineer confirms each one before it becomes a finding. Your code and configuration are never sent to public AI services: models run inside the engagement environment, or on government-authorized endpoints named in your agreement.
This website
Post-quantum TLS
Served only over HTTPS, offering hybrid X25519MLKEM768 key exchange to browsers that support it.
No tracking
No cookies, analytics, or third-party scripts and fonts. One self-hosted animation script, built from an open-source library and served from this domain; every page works without it.
Hardened delivery
A strict content security policy and a DNSSEC-signed domain.
Authenticated email
SPF, DKIM and an enforced DMARC policy on every message from our domain.
Report a vulnerability
Found a security issue in our website, email or tools? Tell us directly.
- Email sy@machersecurity.comDescribe the issue and how to reproduce it. We reply within two business days.
- Please don't test against client systemsThis covers systems Macher owns, not systems we assess for clients.
- Machine-readable contactSecurity tools and researchers look for the same details at /.well-known/security.txt, the internet standard (RFC 9116).