Service line
Security research
We review Android apps for security problems that put their users at risk, then work privately with whoever owns the app to get them fixed.
This is our own work, done on our own initiative. Nobody commissions it, and it is not run for or alongside any bug bounty platform. How we go about it stays between us and the app's owner.
Nothing is published while a problem is still unfixed, which is why there is nothing listed on this page.
What we will and won't do
- We never access real accounts or real people's data.
- We never make a problem public before the app's owner has had a fair chance to fix it.
- We never sell what we find, to anyone.
- We never ask you for money, passwords, or access to your systems.
If you received an email from us
Reply to it directly. The address is research@sumosols.com, and it is published in our security.txt file too — so you can confirm the message really came from us before you answer.
Tell us who on your side should receive the details and we will send them over. There is nothing to pay and nothing to sign. The full step-by-step is on the responsible disclosure page.
Paid reviews
If you own an app and want us to look at it properly — or want a closer look at something we have already reported to you — we take a small number of paid reviews. Write to research@sumosols.com with the app name in the subject line, and we will come back with a scope and a timeline within two business days.