A security desk that only checks what you ask it to.
Authorised targets only · a person approves every check · Bengaluru
SKULL.ORG checks what small and growing Indian businesses rarely have time to check: keys and passwords left in code, outdated software with known holes, websites and cloud accounts set up in a hurry, and the paperwork the DPDP Act and CERT-In now expect. Its AI agents work inside our own office, and a person approves every check before it touches anything of yours.
Updates, reports, projects and releases.
Everything SKULL.ORG publishes lands here: what we checked, what we found on our own systems, the free projects we take on, and tools you can use, with the code on GitHub or a direct download when there is one.
Loading…
Three kinds of work, and public programs.
Secure your systems
Leaked keys and passwords in your repositories, vulnerable dependencies, basic code checks, and a hardening checklist for your website and cloud, with a plain-language report and the fix for each finding.
Compliance readiness
Checklists and evidence trackers for the DPDP Act, CERT-In's directions, ISO 27001 and SOC 2, so you know what is missing before an auditor or a customer asks.
Trace and prove
For victims of crypto theft: the stolen funds followed across public blockchains, an evidence pack with a timeline and a fund-flow graph, sealed with a SHA-256 hash for the police, the exchange or your lawyer. Public data only.
We also take part in public bug-bounty programs and audit contests, strictly inside each program's published scope.
The rules we do not bend.
- Written scope first: every check names what it covers, agreed with you before it starts. No scope, no scan. That rule is written into our software, not just into this page.
- No hacking back: no access to systems that are not yours or your client's, ever.
- No public accusations: who might be behind an incident stays a confidential hypothesis, shared only with you, the exchange, the police or your lawyer.
- No guarantees: a report says what was checked, when, and what it could not check. Nobody can honestly promise a system is safe, and we do not.
- Your data stays yours: findings are kept only as long as the work needs them.
Our first checks are free.
SKULL.ORG is new, and trust has to be earned. So our first security checks for Indian businesses cost nothing: a read-only review of your website's public setup and, if you give us access, a scan of one code repository for leaked secrets and vulnerable dependencies. You get the full report and owe us nothing, and you decide whether we may mention that we worked together.
We run it on our own office first.
Before SKULL.ORG checks anything of yours, it checks ours: a weekly read-only audit of our own machines, repositories and AI agents, an append-only log of every action it takes, and a self-healing routine that fixes what goes wrong in our office before a person has to notice it. What it finds is posted above.