Svonta is a Canadian software and security company. We build web software, networks and cloud platforms. Then we attack them the way a real adversary would, so the weak points get found and fixed before anyone else finds them.
What we do
1 of 7Web development & software engineering
Web applications, APIs and internal tools, built to be read, tested and handed over. We choose proven technology where stability matters and sharper tools where they pay for themselves.
2 of 7Cybersecurity & penetration testing
Authorized, scoped testing of your web apps, APIs, mobile apps, cloud accounts and networks. Each finding comes with proof, its business impact in plain language, and a fix your team can ship.
3 of 7Bug bounty & vulnerability research
Manual research into the bugs automation skims past: broken business logic, authentication flaws, race conditions, and chains of small issues that add up to a breach. We can also help you run a disclosure program of your own.
4 of 7Network security & infrastructure
Segmented networks, zero-trust access, hardened firewalls and monitoring for offices, data centres and hybrid environments. One compromised laptop should stay one compromised laptop.
5 of 7Cloud computing & DevOps
AWS, Azure and Google Cloud environments defined in code, with pipelines that build, test, scan and ship on every merge. When your data has to stay in Canada, we design for Canadian regions from day one.
6 of 7IT consulting & technology solutions
Independent advice on what to build, buy, fix or retire. We assess your systems and your risks, then hand you a roadmap with priorities, costs and a sensible order of work.
7 of 7Digital products & SaaS development
We design, build and run SaaS products end to end: multi-tenant architecture, sign-in and roles, billing, analytics, and the security reviews your enterprise buyers will ask for.
How we work
Every security test starts with a rules-of-engagement document. Ours also covers how we build. Six clauses, written down so you can hold us to them.
Every test is authorized in writing, scoped, and run under rules both sides have signed. No exceptions, no surprises.
The people testing your software know how software gets built. The people building it know how it gets broken.
Every issue comes with a remediation your team can ship. Then we retest it, or we write the patch ourselves.
Threat modelling, dependency scanning and code review run inside the pipeline, long before launch day.
Leaders get risk in business terms. Engineers get exact reproduction steps. Nobody gets jargon for its own sake.
We design for PIPEDA and Québec’s Law 25, and we can keep your systems and data in Canadian cloud regions.
The loop
Software is never finished, so neither is securing it. Each engagement runs this loop, and what we learn in production feeds the next turn.
Goals, constraints and a threat model. We learn how your business makes money, and how it could lose it.
Small, reviewed increments with tests, infrastructure as code and security checks in CI.
Adversarial testing of what we built and what you already run: manual pentesting, abuse cases, failure drills.
Fix, retest, document. Findings become backlog items with owners and dates.
Monitoring, patching and runbooks. Production teaches us what to look at next, and the loop starts again.
The Lab
Three small tools from our side of the table. Everything here runs in your browser and touches no real system.
Simulation · fictional network
Play the attacker against a typical small company. Pick an entry point, then keep moving until you reach the customer database. Then apply our fixes and try again.
CVSS v3.1 base score
Score a vulnerability the way a triage team would. Start from an example or set each metric.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HShell · this page only
Open a shell into this site. Ask it for help, reshape the field, send probes. Somewhere on this page there is a flag. Find it and submit it.
Engage
FAQ
Both. Some clients hire us to build and keep us to test; others start with a test and ask us to fix what we found. We can hand your team clear remediation steps, or ship the fixes ourselves.
It can be, with the right scope. Before testing starts we agree in writing on targets, timing, rate limits and stop conditions, and we stay in contact with your team throughout. Where the risk is too high, we test a staging copy instead.
Yes, always. We only test systems you own or are authorized to have tested, under a signed scope and rules of engagement.
Yes. When your obligations or preferences call for it, we design for Canadian cloud regions and keep data and backups there.
It depends on scope. After a short call we send a written proposal with a fixed price or a clear estimate, and nothing starts until you approve it.
Write to contact@svonta.com with what you found and how to reproduce it. We will acknowledge the report and keep you updated while we fix it.
Contact
A few lines is enough to start. We’ll reply with questions or a time to talk.
Based in Canada