An external penetration-test engagement against Infinihash production services is planned for Q3 2026. This page is a placeholder that documents the plan, the vendor shortlist, the scope, the methodology, and the deliverable timeline. The public executive summary will replace this page in Q4 2026.
Infinihash runs continuous internal scanning today. The Q3 third-party engagement adds an independent adversarial perspective on top of that baseline.
Five candidate firms are under review. Selection criteria: depth in regulated fintech / KYC / KYT, cryptographic and smart-contract competence, regulator-friendly reputation, ability to staff in the Q3 window. Final pick announced at engagement kickoff.
Best in class for cryptographic protocol review and smart contracts. Heavier price tag and longer lead time, but the deepest bench for our settlement and signing surfaces.
Strong web/app security firm; well known for browser, IAM, and SaaS engagements. Good fit for KYC / KYT API surface and the Next.js subdomains.
Crypto-native pentesting and SOC2 readiness work, used by many CEXes and L2s. Fast turnaround, broad coverage, useful pairing with our on-chain components.
Mid-market price point, regulator-recognised in EU; useful as a secondary opinion or for compliance-driven coverage (CER.live, proof-of-reserves, ISO 27001 alignment).
Distributed-research model via Spearbit/Cantina for the contract layer, paired with a traditional web-app shop for KYC / KYT / Coordinator. Best coverage for spend, lower SLA certainty.
Five production services in scope; clear out-of-scope list will be in the SoW. All testing happens against staging clones of production with realistic data fixtures; production endpoints are touched only for limited authenticated-surface verification.
FastAPI service powering kyc.infinihash.com. Document extraction pipeline, Prisma schema, S3 evidence store, retention/TTL/legal-hold, webhook signing, multi-tenant org isolation.
FastAPI + Celery service powering kyt.infinihash.com. Address screening, sanctions ingestion pipeline, SAR/FinCEN export, multi-chain enrichment, public demo screen route.
OpenAI-compatible routing layer + agent registration, GPU agent secrets, JWT issuance, parallel job fan-out. Includes admin secret rotation and webhook surface.
Marketing / lead-capture portal at clearbox.infinihash.com. Static SPA, embedded Typeform/booking flows, session handling, deep-link integrity.
White-label BSA/AML portal at tfc.infinihash.com. Tenant document ingestion, role-based access, KYT proxy passthrough, document upload validation.
Hyperliquid basis dashboard (internal management host, read-only), network administration interface, internal infrastructure gateway, plex/frigate/homeassistant personal stack. May be added in a follow-on engagement.
Three combined approaches over the engagement window. Daily standups with the lead tester; findings filed in real time so we can remediate inside the window rather than waiting on the final report.
Tester accounts at each tier (anon, retail, admin, multi-tenant peer) plus source-code read access to KYC / KYT / Coordinator. Authorization / IDOR / privilege-escalation coverage.
External recon against all public subdomains. TLS / headers / CSP, exposed admin panels, version-leak fingerprinting, public S3 bucket and webhook misconfiguration checks.
npm / pip / Cargo lockfile review, image base inspection, GitHub Actions and deploy pipeline review (S3 / SSM / incus push paths), CI secrets audit, signing-key handling.
Six-week engagement window with a fixed public-disclosure date. High/critical findings are remediated or formally accepted before the public summary lands.
| Milestone | When | Output |
|---|---|---|
| Vendor selection + SoW signed | Q2 W12 | Selected firm + scope confirmation |
| Kickoff + test-account provisioning | Q3 W1 | Engagement begins |
| Mid-engagement readout | Q3 W3 | Interim findings list (private) |
| Draft report | Q3 W4 | Full draft, severity-classified |
| Remediation + retest | Q3 W5 - W6 | High/critical fixed or accepted |
| Final report + public exec summary | Q4 W1 | Replaces this page |
The third-party engagement is layered on top of an internal continuous-scan baseline. The most recent internal scan results are linked below.