Authorization first
No engagement starts without written scope and permission from the system owner.
About Fetion Security
A web security practice that stays through the fix.
Fetion Security (飞讯安全) helps organizations find weaknesses in websites and web applications, then close them. We are built for teams that need a report they can act on — not a pile of unverified scanner noise.
Our work is scoped, authorized, and documented. You get a ranked view of risk, practical remediation guidance, and a retest so “fixed” means verified.
We work in English and Chinese. Engagements start only with written authorization from the system owner. Findings, evidence, and reports stay confidential and are used only to perform the work you asked for.
What we do
- Authorized web application and API assessment.
- Human review of scanner output and business-logic paths.
- Remediation guidance and optional hands-on fix support.
- Retest of closed findings.
What we do not do
- Unauthenticated testing of systems you do not own.
- Help attacking a third party.
- A guarantee of zero remaining vulnerabilities after the project.
How we operate
Signal over volume
We verify findings and rank them so engineers spend time on what actually matters.
Fix is part of the job
Discovery without remediation leaves you exposed. We stay available through the patch and the retest.
How to choose an assessor
If you are comparing firms, these four questions matter more than a logo wall.
Will they wait for authorization?
Anyone willing to scan a live site without written permission is not a vendor you want.
Do they verify findings?
A raw scanner export wastes engineering time. Ask who reproduces each issue.
Do they stay for the fix?
A PDF alone is not remediation. Ask how they support the patch.
Do they retest?
“Closed in Jira” is not the same as “closed in production.” Ask for verification.