How I investigate.

Mikaeel Majiet, security researcher · Updated 19 October 2026

I investigate whether someone outside your company could reach your customer data, misuse an account or gain access to production systems. The work follows the evidence across the systems in your agreed scope.

Start with the question

Every engagement begins with the question you need answered: a customer security review, a finding your team needs to resolve, or a system you have just shipped. We agree the systems covered, your priorities, the assessment window and the fee before any work starts.

How testing is done

Testing stays inside the systems you list and the window we agree. I use non-destructive, reversible methods. When a finding needs proof, I take it only as far as a bounded proof: enough to show the consequence, no further. I use controlled test data where possible and keep sensitive evidence to a minimum.

Evidence and the report

Your signed report records what I tested, what I found and what happened after the changes. Each finding has a dated status. Anything still open, or outside the testing, is stated. There is a summary for the person reviewing your company's security, with supporting evidence for your engineers.

Fix, then test again

I help your engineers address the findings, then repeat the relevant tests to check the result.

Carpet permission

Standing permission for non-destructive, reversible testing of the agreed company systems. A Free security level request includes this permission, in these words:

I confirm that I can authorise testing of the company systems listed in this request. I give Studio Majiet Carpet permission to audit, scan and penetration-test those systems using non-destructive, reversible methods, including following findings through to a bounded proof and checking whether the relevant controls hold.

Routine testing within the agreed assets and assessment window does not require my approval at every step. This permission excludes destructive or irreversible actions, service disruption, third-party systems and actions beyond my authority.

Studio Majiet will use controlled test data where possible, minimise sensitive evidence and record cleanup for reversible changes. Testing begins after my authority, the asset list and assessment window are confirmed. I can withdraw permission by emailing security@mikaeelmajiet.com.

SM-CP-2026-10-19

To withdraw permission at any time, email security@mikaeelmajiet.com. Testing stops when I receive it.