I test your website and Android apps the same way a real attacker would. Within 7 business days you get a plain-English report of every problem I found and exactly how to fix it.
My bug bounty track record since early 2026, last updated October 2026. Public profiles: Bugcrowd, HackerOne, HackenProof.
Think of it like hiring someone to try every door and window of your shop after hours, then handing you a list of which ones were unlocked and how to lock them. In the industry this is called a penetration test.
All I need is your website address and links to your apps. You don't give me passwords, access to your systems, or your code. I see exactly what a stranger on the internet sees.
I sign up as a normal customer and look for ways to see other customers' details, get things without paying, or reach areas only your staff should see.
Each problem explained in plain English. What an attacker could do, how serious it is, and what your developer or IT provider needs to change.
In this work I see a lot of exposed customer information: names, addresses, phone numbers, order histories. For a large company a breach is a bad headline. For a small or mid-size business it can be the end of the business. There's the cost of cleaning up, the legal obligation to tell your customers, and the customers who don't come back.
Average reported cost of a cybercrime to an Australian small business. A$97,166 for medium businesses.
ASD Cyber Threat Report 2024-25Data breaches reported to the Australian privacy regulator in 2025, the most on record. When customer information leaks, the law can require you to tell your customers and the regulator.
OAIC, July 2026Australian small businesses spend nothing at all on cyber security.
auDA, Digital Lives of Australians 2025I'm Marius du Preez. Since early 2026 I have been finding security problems full time through bug bounty programs, where companies pay independent researchers to find security holes before criminals do. I've also spent 9+ years running my own businesses, so I look at every problem I find through a business owner's eyes.
What I've seen worries me. My reports don't go straight to the business. They go to a triage team at the bug bounty platform first, which decides what gets passed on. That can take weeks, sometimes months. One of mine took five months to be resolved.
Serious problems also get lost. Someone reports a weakness, it's labelled low impact, and the business may decide it isn't worth fixing. Months later I find the same weakness and show it can be used to take over customer accounts. But my report is closed as a duplicate of the original "low impact" one, so the business never learns how serious it really is. The hole stays open.
And again and again, a serious problem I found had already been reported by someone else. Still not fixed. Still open to anyone who found it. With AI helping attackers find these problems faster than ever, leaving a hole open for months is a much bigger risk than it used to be.
So I'm doing something about it. I want to put what I find straight in front of the person who owns the business, with nobody in between, so it actually gets fixed.
Critical or high severity problems I found that someone else had already reported, and that were still open.
Of my critical or high severity reports that triage marked down to low or medium.
The longest one of my reports has taken to be resolved.
From my own bug bounty reports, October 2026.
Just your name and business email. A quick code confirms it.
You confirm your domain with a DNS record (your IT provider can add it) and tell me what to test. I review it and email the agreement to your owner or a director, who reads and signs it online. Nothing is tested until it's signed.
From the outside, the way an attacker would. Nothing is needed from your team. Your report arrives within 7 business days of signing, sometimes sooner.
A short summary written for you, plus full details your developer or IT provider can use to fix each problem.
Pay what you think it was worth, or nothing. No follow-up, no pressure. A re-check after your fixes is included.
Customer logins, online stores, booking and checkout pages, and any staff or admin areas that can be reached from the internet.
Android apps are often overlooked. I take them apart to find hidden passwords, keys, and ways into your systems that your website never shows.
The behind-the-scenes services your website and apps talk to. This is where most serious customer data leaks actually happen.
I sign up as a normal customer using my own accounts, and prove problems using those accounts. I don't need to go into your real customers' accounts to show you what's wrong.
I use AI to help with testing. It's part of how almost every business works now, and it's the only way to properly check a website and its apps and have your report back within 7 business days instead of a month.
But AI gets a lot wrong. Point an AI tool at your website and it will hand you a long list of alarming warnings. Most of them are false alarms or too minor to matter. From my own work, only about 1 in 10 things AI flags turn out to be real problems worth fixing.
Telling the difference is the part that takes skill and time. I check and prove every finding by hand before it goes in your report. You get the real problems, not a scary list that sends your team chasing things that were never there.
I test with my own accounts and steer clear of your customers' real information. Any personal details that turn up are blanked out on my own machines wherever possible before AI tools are used, and the agreement sets out exactly how data is handled.
I don't flood your site with traffic or try to knock it offline. Testing is paced gently and stops the moment you ask.
What I test, how I test it, and how information is handled are all set out in a short agreement before anything starts.
| Typical security firm | This test | |
|---|---|---|
| Price | Often A$14,000 to $36,000 for a website and apps, quoted upfront | You set it, after reading the report |
| Time to report | 4 to 8 weeks from first call | Within 7 business days of the agreement being signed, sometimes sooner |
| Android apps | Usually priced as a separate job | Included |
| What you provide | Often logins, special test setups, and staff time | Your website address and app links |
| Re-check after fixes | Varies, sometimes extra | Included |
Pricing is based on published 2025-2026 US figures for website and mobile app testing (about US$10,000 to $25,000), converted at October 2026 exchange rates. Timelines are based on published figures from security testing firms.
Not every application is a fit. I review every application personally and decide whether to take it on. If it isn't a fit, I'll let you know, and nothing is tested.
There isn't one. You get the full report whether you pay or not. Some businesses will pay, some won't. I would rather the issues get fixed than not get found at all.
Then your report says so, and lists exactly what was tested. That's still useful: a dated, independent check you can show insurers and larger customers. As always, you decide what it was worth.
No. The report starts with a short summary written for business owners: what's wrong, how serious it is, and what to fix first. The detailed section is for whoever looks after your website or apps.
Not at the moment. I test websites and Android apps. If you have an iPhone app as well, it usually talks to the same systems behind the scenes as your website and Android app, so many of the problems that affect it get found and fixed anyway.
I test as a normal customer using my own accounts. I don't flood your site with traffic or try to knock it offline, and testing stops the moment you ask.
I test with my own accounts and avoid your customers' real information. Any personal details I come across are blanked out on my own machines wherever possible before I use AI tools. The agreement explains how data is handled, including when AI services may process it, how long anything is kept and when it is deleted. What I find stays between us.
I let you know straight away rather than waiting for the report, so your team can start fixing it.
No. I don't hold formal certifications. What I have is a full-time bug bounty track record, 8 years in cloud infrastructure, and 9+ years running my own businesses. The numbers are near the top of this page, and my profiles on the bug bounty platforms are public.
Insurers and larger customers often ask whether you've had an independent security test. The report gives you a dated answer to that. It is not a formal compliance audit, so if you need one for a specific certification, check what your auditor requires.
Yes, up to 15 a month. Every finding is checked and proven by hand before it goes in a report, and a limit keeps that standard where it should be.
Yes. I'm based in Brisbane and test businesses anywhere in the world. Amounts on this page are in Australian dollars only because that's where I'm based. If you choose to pay after your report, your card converts it to your currency automatically.
Apply with your business email, confirm your domain, and tell me what to test. I'll review it and send a short agreement.