Independent security research.
We find vulnerabilities that automated scanners miss — and deliver reports your team can act on immediately.
What we do
Raijuna is an independent security research lab. We test web applications, APIs, authentication flows, and cloud infrastructure through deep manual review. No scan-and-dump — every finding is manually verified with proof-of-concept reproduction.
We specialize in the vulnerabilities that matter most: broken access control, business logic flaws, authentication bypasses, and multi-step attack chains that require understanding how an application actually works before you can identify where it breaks.
Track record
400+ targets assessed across FinTech, cryptocurrency, healthcare, defense, enterprise SaaS, and cloud infrastructure. 1,400+ vulnerabilities reported through coordinated disclosure. 320+ critical-severity findings.
Our methodology
Reconnaissance
Scope definition, subdomain enumeration, technology fingerprinting, and attack surface discovery.
Attack Surface Mapping
Identifying authentication flows, authorization boundaries, data input points, and business logic workflows.
Manual Testing
Deep manual review of business logic, authentication, and authorization. Static analysis and dynamic testing of every component.
Exploitation & PoC
Every finding verified with proof-of-concept reproduction. CVSS scoring and realistic impact assessment.
Reporting & Remediation
Executive summary, technical findings, attack chain documentation, and step-by-step remediation with code-level guidance.
Who is behind the work
Raijuna is led by practitioners who came up through hands-on offensive security — web application testing, red-team engagements, and coordinated vulnerability disclosure — rather than through security sales or compliance paperwork. The people who write the findings are the people who found them, which is why the reports read like attack notes and not questionnaire answers.
The lab's public work lives in three places: the case studies and writeups published after engagements, the security glossary maintained as a reference for both clients and practitioners, and the open tools built to solve problems we kept hitting in the field. Each is verifiable — the writeups document real attack chains, the glossary entries carry sources, and the tools are public code.
Disclosure work is coordinated through vendor programs and published advisories where the vendor permits; where details must stay confidential, the count and class of findings are what this site reports — never a client name or a system that was not cleared for disclosure.
Working with us
One-time assessments or ongoing partnership. Whether you need a focused review of a specific application or regular security testing as part of your release cycle, we scope each engagement individually.
Every engagement includes: detailed reconnaissance, manual testing beyond automated scanning, verified findings with proof-of-concept reproduction, executive and technical reporting, and verification retesting after fixes are implemented.
Request an Assessment