Engagements start with a two-week Pilot Audit ($15,000, fixed scope, one repository or component). Customers who continue can choose a Focused Audit, a Full Verified Audit, a Triage Retainer for incoming AI-generated reports, or per-class Patch Validation. Open-source maintainers run under an approval-based contribution track.
[Service menu]
Stella sells verification work — not seats, not scans. Most teams start with a fixed-scope Pilot Audit ($15,000, two weeks). Customers who continue can choose a Focused Audit, a Full Verified Audit, a Triage Retainer, or per-class Patch Validation. Open-source maintainers run free under an approval-based contribution track.
Fixed-scope entry audit
$15,000fixed fee · 2 weeks
The starting point for first customers and teams who want to see Stella's deliverable quality on one repository or component before expanding scope.
Deeper work on a narrow surface
$18K–$25K2–3-week engagement
For teams that want more depth than the pilot but are not ready for a full 4-week audit. Best for one library, firmware component, parser, protocol surface, or robotics / embedded component.
Full-scope verification of one product area
From $30K4-week engagement
One product area or protocol surface you ship. Best for product-security teams that need a full-scope verification cycle ending in patch validation, embargo coordination, and CVE submission support.
Verify incoming AI-generated reports
$8K–$20Kper month
PSIRTs and bug-bounty programs drowning in AI-generated submissions. We classify each incoming report as real, duplicate, false positive, or security-relevant, and return the engineering-actionable shortlist.
Confirm the fix holds — no variants left
$5K–$12Kper vulnerability class
Vendors with embargoed CVEs or compliance pressure who need an independent check that the patch actually fixes the root cause and that no variant remains in adjacent code paths.
Our contribution to critical OSS security
Freeapproval-based
Maintainers of significant open-source C/C++ infrastructure projects. Not the primary offering — this is how Stella gives back to the upstream ecosystem we depend on.
Early-stage and first-time customer scopes can start smaller. We are happy to scope a narrow component before expanding into a full product-area audit.
[Why this works]
Stella combines specialist memory-corruption craft with a verification-first delivery model — the gap that has opened as frontier LLMs commoditize discovery but not validation. These four moats are why infrastructure vendors choose us over horizontal scanners or generic AI services.
[ 01 ]
Frontier models, fuzzers, and static analyzers now generate more candidate vulnerabilities than maintainers can triage. Lilith reproduces every candidate on isolated GCP VMs with AddressSanitizer / UBSan / MSan before a finding leaves the pipeline. You pay for verified findings you can patch, not triage queues.
[ 02 ]
Memory-corruption in cryptographic libraries, VPN daemons, DNS servers, routers, SIP gateways, and embedded TCP/IP stacks is too narrow for horizontal SaaS players (Snyk, Semgrep, Wiz) and too valuable for vendors to leave unaudited. Roughly five firms in the world do this work seriously; Stella is the youngest, with the deepest LLM-augmented verification harness in production.
[ 03 ]
Every verified finding ships with disclosure language, vendor security contacts, embargo timeline, and a 1-week patch-validation window. Stella has coordinated with Mozilla, Arm PSIRT, Intel, ISC, PowerDNS, and Red Hat Product Security — the relationships needed to get a CVE through cleanly are part of the engagement, not a separate billable.
[ 04 ]
32 CVEs assigned across wolfSSL, Mozilla NSS, GnuTLS, strongSwan, PowerDNS, Arm mbedTLS, PostgreSQL/PgBouncer, and FRRouting. $75K+ in paid or confirmed bounty awards from Mozilla, Intel, Intigriti, and YesWeHack, plus additional disclosures coordinated through Red Hat. New entrants start from zero credibility — and the gap grows with every CVE Stella publishes.
[Approach]
Traditional specialist audits can be expensive and calendar-heavy. Stella starts with a fixed-scope pilot and delivers verified, reproducible findings on a faster cadence.
[Frequently asked questions]
[ $ lilith run --target your-codebase ]
Tell us about the codebase you want audited. We respond within 24 hours with scoping questions and an engagement proposal.