About the Practice · Brooklyn, NY
Linden Street, After Hours — One Lantern Lit, One Countersigned Scope on the Desk, and a Tenant ID That Should Not Have Answered.
Harbor Lantern is an offensive security practice at 176 Linden Street in Brooklyn, NY. We test the software of mid-sized SaaS companies — the web application, the API behind it, the cloud accounts beneath that, and the people who answer its email — and we set down, in order, what an attacker would reach first.
On the Name
A Lantern on the Harbor Shows the Rocks Before the Hull Does
Harbors were lit for a plain reason: the channel is read most safely before you are in it.
The practice takes its name from that duty. Under signed authority, we enter your environment ahead of anyone who would not ask permission, and we chart what lies beneath the waterline — the cross-tenant read, the IAM role created during a migration and never retired, the invoice pretext your finance team would open without a second glance.
What you receive is the chart itself: each hazard located, reproduced in writing, and ranked by how directly an attacker would arrive at it. Your engineers steer; we hold the light.
Standing Orders
The Rules the Practice Works Under, Whoever the Client
These are not aspirations. Each order describes a document you will hold, a call you will receive, or a line in your invoice — and each can be checked against the engagement once it closes.
| Order | The rule | In practice | Where you will see it |
|---|---|---|---|
| INon-Negotiable | Nothing is touched before the scope is countersigned. |
Testing windows, source IPs, rate limits, out-of-bounds systems, and a stop word are agreed in writing. Reconnaissance does not begin until both signatures are on the page. |
Rules of engagement, signed before day one |
| II | The name on the proposal is the name on the report. |
The engineer who joins your scoping call leads the testing window and reads the findings aloud at the debrief. The engagement is not handed down a chain. |
Proposal, report cover, debrief invite |
| III | Reach is ranked before score. |
Findings are ordered by how far an attacker travels from them. A CVSS rating is printed alongside each one, never in place of that judgment. |
Remediation roadmap, page one |
| IVSame Day | A confirmed critical is telephoned. |
Your designated contact hears it by phone the business day it is confirmed, with written reproduction steps behind the call. Testing on that path pauses until you decide. |
Escalation sheet, agreed at kickoff |
| V | Every finding reproduces from the page alone. |
Before a report is released, each finding is re-run from its written steps, without notes or memory. If the steps fail, the finding is rewritten or withdrawn. |
Reproduction steps, per finding |
| VI | The fee holds once testing starts. |
A fixed fee is agreed after scoping. Any change in scope is priced and countersigned before additional work begins — never discovered on an invoice. |
Proposal and change order |
| VII | Artefacts are deleted, and the deletion is confirmed. |
Reports travel through an encrypted share. Testing artefacts are kept only until the retest closes, then destroyed, and we put that in writing. |
Closure letter after retest |
Requests We Turn Down
Four Requests the Practice Declines, and What It Offers Instead
A firm is defined as much by the work it refuses as by the work it accepts. These requests reach us often enough that our answer is written down.
-
The request
“Could you take a quick look at our login page before Friday? No paperwork needed.”
No system is tested without written authorization from its owner — not a single request, not as a courtesy. Unauthorized testing exposes you and us alike.
InsteadA forty-minute scoping call this week, and a signed rules-of-engagement document before any packet is sent.
Book the scoping call → -
The request
“Run the scanner, put it on letterhead, and call it a penetration test.”
A scanner export is a list of possibilities. An enterprise buyer’s security team can tell the difference, and so can an attacker. Automated tooling supports our testing; it never leads it.
InsteadA manual Web Application & API test against two roles and two tenants, from $14,750.
See what the test covers → -
The request
“Can you issue the SOC 2 report yourselves?”
Harbor Lantern is not a CPA firm, and SOC 2 reports are issued only by licensed auditors. Saying otherwise would cost you the report your customers actually require.
InsteadA four-week readiness assessment that maps every control to its evidence and its owner, for $18,900.
Read the assessment scope → -
The request
“Leave the critical out of the report — we’ll fix it next quarter.”
A finding, once confirmed, is reported. We will record the remediation date you commit to, and the retest will mark it closed when it is — but it will not be omitted.
InsteadAn owner and an effort estimate against the finding, and a fixed-fee retest at $2,350 when it is fixed.
How the retest works →
During a Testing Window
What Sits on the Desk While Your Window Is Open
An engagement is conducted in documents as much as in terminals. These five things are within arm’s reach of the engineer for every hour your environment is under test.
-
The rules of engagementPrinted & signed
Windows, source IPs, rate limits, and the systems marked out of bounds — on paper, so nothing depends on a browser tab.
-
The stop-word cardBy the phone
One word, agreed at kickoff. If it is spoken by your team or ours, testing ceases until both sides agree to resume.
-
The escalation sheetTwo names
Your designated contact and a backup, with numbers. A confirmed critical goes to the first; if unanswered, to the second.
-
The testing laptopOne client at a time
Your engagement’s notes and evidence live in an encrypted workspace that holds no other client’s data during the window.
-
The lanternLit
A copper lamp on the corner of the desk, switched on when a window opens and off when the retest closes. A small ritual, kept deliberately.
The Practice Address
One Address, on Linden Street, Kept by Appointment
Scoping calls and debriefs are arranged in advance, by telephone or video, and in person on Linden Street when your team prefers a table to a screen. Bring the architecture diagram; we will supply the coffee and the questions.
- Address
- 176 linden street, brooklyn, NY 11221
- Hours
- By appointment — book a call
- Telephone
- (718) 221-8018