Independent bug bounty crew · invite-only engagements

We're a small crew of full-time bug bounty hunters. We find the bugs scanners miss in your web apps, APIs, mobile and cloud, prove them, and stay until they're fixed.

Work with us → What we do
  • Manual testing, not scanners
  • NDA from day one
  • Retests included
High
SSRF in PDF export serviceExample · web app
Critical
Account takeover via OAuth redirectExample · auth flow

About the crew

A small crew. Big findings.

Clever Flamingo is a tight group of independent hunters who met on the leaderboards of the world's biggest bug bounty programs. We've spent years finding the bugs that matter: account takeovers, payment logic flaws, cloud keys left in the open.

Now we bring that same obsession straight to companies. No platform, no crowd of strangers: you get the same handful of senior hackers on every engagement, talking to your engineers directly.

01

Hunters, not a platform

You work with the people who actually find the bugs. No middlemen, no triage queue.

02

Manual first

Tools do recon. Humans chain the bugs: business logic, auth flows, race conditions.

03

Proof, not noise

Every report ships with a working proof of concept, real impact and a clear fix.

What we do for companies

Point us at it. We'll break it first.

Private bug bounty engagements

Our crew hunts your scope like a live program, paid per valid finding, under NDA and your rules.

Targeted penetration tests

Fixed-scope, time-boxed tests of a new app, API or release, with a report your auditors accept.

Continuous attack-surface hunting

Monthly retainer: we watch new assets, releases and subdomains and hunt them as they appear.

Retest & fix verification

We try to break every fix again, including bypasses, before you close the ticket.

Responsible disclosure help

Set up a disclosure policy and security.txt, and get help handling reports from outside researchers.

What we hunt

The bugs that actually hurt.

What scanners miss and attackers try first.

  • Critical
    Account takeoverOAuth, SSO, password reset and session flaws that hand over any account
  • Critical
    Leaked secrets & cloud misconfigKeys baked into app builds, open buckets, IAM roles that can assume everything
  • High
    Business logic & race conditionsDouble refunds, coupon stacking, checkout flows that pay out twice
  • High
    Broken access control & IDOROne customer reading another's invoices, users or data
  • Medium
    Forgotten assets & subdomain takeoverStaging boxes, dangling DNS and old apps nobody remembers owning

How we work

Four steps. Zero fluff.

01

Scope call

30 minutes with your team: what matters, what's off-limits, how you want reports.

02

The hunt

The crew splits your surface by specialty and goes deep, the way we hunt live programs.

03

Proof & report

Each finding lands with a PoC, impact and a fix, straight into your tracker.

04

Retest

We verify every fix and try to bypass it. Done means actually fixed.

Got something worth breaking?

Tell us what you're shipping. We'll come back within one business day with a scope and a plan.

Work with us → [email protected]