Offensive security
Find the gaps before attackers do
Pentesting, audits and continuous security done by hand, using the same techniques that find critical bugs in the most hardened platforms in the world.
Vulnerabilities reported and accepted at
- PayPal
- Shopify
- Snapchat
- OKX
- MetaMask
And other Fortune 500 companies and global leaders in their sector, through their bug bounty programs.
View track record on HackerOneIf you're reading this, chances are
- 01A client or an investor is asking for a pentest report and you don't have one.
- 02Your last audit was an automated scan nobody on the team took seriously.
- 03You ship every week and nobody is watching what each release exposes to the world.
Services in this line
What you get
Real findings, not noise
Every vulnerability comes with a reproducible proof of concept and business impact. If it can't be exploited, it isn't reported.
The report your client accepts
Executive summary for leadership, technical detail for your team. Ready to show in due diligence or to an enterprise customer.
Retest included
When your team fixes it, it gets tested again. The work doesn't end with the report — it ends when the flaw is closed.
Who's behind this
Javier Corral
Founder · Bug bounty hunter and software engineer
There's no agency behind Crackonce. There's a working hacker.
Two-time world champion in HackerOne's competitions and top hacker at H1-65 Singapore, with vulnerabilities reported and accepted at platforms like PayPal, Shopify, Snapchat, OKX and MetaMask. Software engineer, University of Ciudad Real.
The same person who competes against the best hackers in the world is the one auditing your systems — and writing your code. No middlemen, no juniors executing work a salesperson sold you.
- 2×
- World champion · HackerOne
- H1-65
- Top hacker of the event · Singapore
- BSc
- Software Engineering · University of Ciudad Real
How we work
A clear process from start to finish. No surprises in scope or in the invoice.
- 01
Scoping
One call to understand your product, your risks and your goals. Together we define what gets tested — or built.
- 02
Proposal
Within 48 hours you get a fixed proposal: scope, timeline and fixed price. No fine print.
- 03
Execution
Manual work and continuous communication. Critical findings are reported immediately, not at the end.
- 04
Delivery & retest
Final report or product, a review session with your team, and verification that the fixes actually work.
One consultancy, three disciplines
Problems rarely come alone: a slow application usually also has a badly indexed database and weak access control. Here you don't get referred to another vendor — it all gets solved under one roof.
Tell me what you need
An audit, a pentest or a digital product. Reply within 24 hours and a fixed proposal within 48.