The SquadWorld ModelEvidenceAccess

Rethink the Obvious.

We craft what holds under load and expose what was destined to fail. No theater, no high-visibility vests.

What we do best

Multi-Agent Software Security Investigations

We run digital products through a purpose-built, multi-agent investigation pipeline. Hundreds of specialized agents examine code, dependencies, APIs, configurations and attack surfaces in parallel, trace connections and flag suspicious behavior. Our human specialists then turn the correlated evidence into a detailed roadmap of what was found, so developers get a clear picture they can verify and act on.

How a review happens

1
Send
A GitHub link, a repository archive, a package build or an API specification.
2
Examine
Our team and one, several or all of our agents work through source, configuration and data flows together.
3
Re-verify
Every finding is always re-verified by our human specialists before it reaches the report.
4
Evidence
We document the examination in writing, with the evidence for each finding.

What we examine

Source and dependencies
Code, third-party libraries and their versions.
Authorization and actions
Permissions, data access and abuse paths.
API authorization logic
Authentication, access control and trust boundaries.
Credentials and data flows
Exposed keys, embedded SDKs, flows to third parties.
Misconfigurations and bugs
Insecure defaults, overly broad permissions, software defects.
The evidence
Our work, documented and checkable.
  • Broad technical coverage
    Code, dependencies, APIs, configurations and data flows, examined together.
  • Exploitability analysis
    Findings checked for what an attacker could realistically do with them.
  • Standards-informed methodology
    Testing grounded in recognized security frameworks.
  • Correlated knowledge graph
    Every report ships with a base knowledge graph linking findings together, not just a flat list.
Domain Live Testing
Free check

The initial check is read-only, performed from a European IP address, with no login and no payloads. Your systems remain unchanged.

A researcher reviews your request before any check begins and replies within one business day. You receive a short written report with our findings, likely attack scenarios, the potential financial impact and clear next steps, plus a knowledge graph of everything we found. All free.

387+
Android/iOS apps audited
970+
Weak points found and documented
262+
Critical findings recorded

Areas of Magnification

Where our attention falls

How intricate systems behave: how evidence becomes structure, how relationships change over time, and where one butterfly can move an entire network.

Research Cooperation

Together with the Emergent Interaction Lab

The Emergent Interaction Lab is our research partner. The Lab does the research, we build and operate the systems. Its lead, Laura Serna Gaviria, sits on our board of co-founders. Where we work together, we say so.

Laura Serna Gaviria

Co-Founder & COO, RFI-IRFOS · Lead, Emergent Interaction Lab

@emergentinteractionlab
Website

Laura is an interdisciplinary researcher, systems architect and founder of the Emergent Interaction Lab. Her work spans artificial intelligence, human cognition, behavioral analysis and the study of emergent phenomena, with a focus on how complex systems behave, develop and acquire new capabilities.

Since 2023, she has conducted extensive longitudinal research into human–AI interaction. She developed original methodologies to identify, reconstruct and evaluate cognitive, behavioral and systemic patterns, and her research also addresses consciousness, perspective-taking, decision processes and the evolution of intelligence.

She designs complex intelligence architectures, autonomous multi-agent systems and computational research environments, including KERNEL, ERIS, SELFGRAPH and Laura's Agents. Her contributions to RFI-IRFOS include causal reconstruction, cognitive modeling and World Model development.

Contact & Disclosures

Reach out

One form, even if it's just a first talk: a question, a service inquiry, research collaboration, or a security finding. Findings come to us directly, never through a third-party bug bounty platform. We would refuse to be routed through one ourselves.

Not sure what to pick on the right? General inquiries reaches a human either way - or email one of these directly.

Sending a security finding? See our full disclosure-handling policy - triage, lawful basis, and your choice of credit.

Regardless of the nature of your request, expect a reply from one of our actually human team members within 12h after it hits our inbox.

© 2026 RFI-IRFOS  ·  Graz, Austria  ·  GISA 39261441  ·  UID ATU83405245

Foundation

Intelligence

World Model

Applications

Repositories

Crates (crates.io)

all packages →

this is a useless cookie banner. it's just here to look like one * we don't use cookies, so there's nothing to consent to. don't let anyone tell you otherwise.two buttons, one closes this and throws some confetti. the other literally does nothing.