Contact Us
Backed by Expertise · Open Source Security

Because breaches aren't an option.

Don't let your workflows work against you.

PurpleLotus finds business logic flaws and multi-step vulnerabilities that traditional tools miss — without drowning you in noise. Built for open source teams who ship fast and can't look away.

Backed by Expertise — researchers, advisors & allies

Microsoft HoF Recognized for responsibly disclosing critical vulnerabilities in Microsoft's cloud & identity infrastructure
GitHub Security Listed in GitHub's Security Hall of Fame for responsible disclosure in core platform features
OWASP Standards All assessments follow OWASP Testing Guide v4.2 and Top 10 methodology across every engagement
CREST Certified Internationally recognised penetration testing standards, ethics, and professional conduct
CVE Programme Active CVE contributors — we find, report, and help patch real vulnerabilities in widely-used software
Bug Bounty Elite Top-ranked researchers across HackerOne, Bugcrowd and Intigriti with critical-severity findings
Open Source Trust Trusted by maintainers of widely-used npm, PyPI, and Go packages to audit before major releases
OpenSSF Supply Chain SIG Contributing members of the Open Source Security Foundation's Supply Chain Security working group
Why PurpleLotus

Open source is the new attack surface.

96% of codebases contain open source components
supply chain attacks YoY since 2020
742 avg. days to detect a supply chain breach

Modern software is assembled, not written. Every package you pull is a door you're leaving ajar. Traditional scanners see the doors — PurpleLotus sees who's walking through them and how they chain attacks together.

We find business logic flaws and multi-step vulnerabilities that automated tools fundamentally cannot detect. The kind that turn a low-severity misconfiguration into a full supply chain compromise.

Our researchers have been there. They've exploited the same classes of bugs in production at scale. That experience is why Microsoft and GitHub trust us enough to list us in their halls of fame.

"Because breaches aren't an option. Don't let your workflows work against you."

SecureCI/CD — supply chain security that ships with your code.

Protect your GitHub CI/CD pipelines with real-time threat detection, automated security checks, and robust access controls for a secure software lifecycle. PurpleLotus integrates directly into your pull request workflow — no dashboard-switching, no alert fatigue.

We scan for dependency confusion, typosquatting, malicious package injections, secrets leakage, and pipeline privilege escalation — the exact vectors attackers use to poison open source at the source.

GitHub Native PR Bot Zero Config Real-time Open Source Ready
Case Study · Why It Matters

The SolarWinds Playbook

The 2020 SolarWinds attack inserted malicious code into a software update, impacting thousands of organisations including US government agencies. Attackers didn't break in — they were invited through a poisoned build pipeline.

SecureCI/CD is engineered specifically to detect and block this class of supply chain attack before your update ships to users.

01 — Detection

Dependency Poisoning

Real-time scanning for dependency confusion, typosquatting, and malicious package injections across npm, PyPI, Maven and Go modules at every PR.

02 — Pipeline

CI/CD Integrity

Monitors GitHub Actions workflows for secrets exposure, permission escalation, and unpinned third-party actions across your entire organisation.

03 — Response

PR-Level Remediation

Automated PR comments with reproduction steps, fix suggestions and severity scoring — so developers act without ever leaving GitHub.

Services

Penetration Testing Services

01

Network Penetration Testing

Simulate attacks to uncover network vulnerabilities. We go beyond automated checklists to find the chained multi-step paths adversaries actually exploit in the real world.

02

Application Penetration Testing

Test web and mobile apps for security flaws — business logic bypasses, authentication weaknesses, and deep injection vulnerabilities that scanners consistently miss.

03

Social Engineering Testing

Assess susceptibility to phishing and social attacks with realistic simulation campaigns that surface your human attack surface before adversaries find it first.

Pricing

Choose the plan that fits your security needs.

Free
$0
forever · no credit card required
  • Basic CI/CD pipeline scanning
  • Up to 3 GitHub repositories
  • Community support
  • Weekly security summary
  • Limited vulnerability detection
Get Started Free
FAQ

FAQs — PurpleLotus

What types of pentesting does PurpleLotus offer? +
We offer web, mobile, cloud, network, and CI/CD pentesting tailored to modern threat landscapes — with a particular focus on supply chain and open source pipeline security.
How are PurpleLotus pentests different from others? +
We go beyond checklists — focusing on real-world exploitation paths, misconfigurations, and chained logic flaws. Our researchers find the paths that automated tools fundamentally cannot detect.
Do you provide a detailed vulnerability report? +
Yes. Every engagement includes a prioritized, developer-friendly report with reproduction steps, CVSS scoring, and actionable remediation guidance written for your specific stack.
Are your tests manual or automated? +
We combine automated scanning with expert-driven manual testing to uncover deep vulnerabilities. Automation finds the breadth; our humans find the depth and the business logic flaws.
Is PurpleLotus certified or recognised? +
Yes. Our researchers are listed in top security halls of fame including Microsoft and GitHub, and we follow OWASP and CREST standards throughout every engagement.
Do you support open source projects? +
Absolutely. SecureCI/CD is free for qualifying open source projects. We believe the open source ecosystem deserves first-class security tooling — reach out with your project details.

Security that ships
with your code.

PurpleLotus