Picklock Labs for OSTLER
Case PL-2611
$284,000 Sign the rules

Four ways in. One vault. Twelve weeks.

A red team engagement from Picklock Labs for Ostler Payments, planned with Mara. Four operators try to reach your card data the way a real crew would, report every step with its fix, and stop the moment you say so.

Plan the job See the price
PL-2611case
$284,000fixed price
12 weeksfrom January 11
Dec 4, 2026open until

Ostler Payments, attack surface as planned. Strings in red, out of bounds hatched.

You asked how far someone would get.

Mara, from our call on October 21 and the note you sent after it.

“Five pen test reports in four years. Two hundred pages each, and not one of them told me if someone could reach the vault.”

Mara, Chief Information Security Officer

“If you take authorization down for ten minutes, that's the last test we ever run.”

Mara, on what keeps her up

“My board will ask one thing after. Could it happen here, and what are we doing about it.”

Mara, on the readout

Four people will try to get there.

The same four from the first call to the readout. Each one owns a way in, and Jonah owns the rules.

Plan the job.

Pick the ways in and the rules. Tap a marker on the board or a card beside it. The scope, the weeks and the price redraw as you go.

Ways in

Each is one operator's window. Drop any of them.

Rules

When we work, who knows, what we never touch.

  • Authorization switch, never touched
  • Merchant payout runs, never touched
  • Real card numbers, never read
a string we'll pullleft aloneout of boundsthe vault, a planted test card only

Scope

Twelve weeks

Price

$284,000

Fixed. Four ways in, any hour.

Here's what you'd get back.

A sample finding, written against a made-up environment so you can judge the format before you buy it. Six steps from first foothold to the vault, each with its fix.

    Use the arrow keys or the buttons. Sample findings are illustrations and never describe Ostler's systems.

    One path, string by string.

    An illustration drawn on your building. It shows how we'll report a path, and makes no claim about what we'll find.

    Clock08:52Elapsed0h 00mSeen by your teamNo

      Your three questions, Mara.

      From the October 21 call. Each answered here, with a tool you can try.

      1

      How do we avoid an outage?

      Three things are out of bounds in every option, production is look-only, and you can stop us with one word. Try it.

      0:00
      Never touchedThe authorization switch and merchant payout runs. Not scanned, not probed, not logged into.
      Look onlyEvery other production system. We read, we never change or restart anything.
      Test cards onlyThe vault proof is one test card you plant. No real card number is ever read.
      2

      Who on my team is told?

      As few people as you choose. The fewer who know, the more we learn about how your team spots us.

      3

      What does the board see after?

      One page they can read in two minutes. Your engineers get the full report, with every step and fix.

      Ways tested come from your board. The findings shown are the sample above.

      The price, line by line.

      One fixed price for the scope you sign. The base is the same in every option, and each way in drops on its own.

      Total

      $284,000

      Twelve weeks, fixed. January 11 to April 2, 2027.

      When you pay

      What we'd buy

      All four ways in, at any hour, with you and Priya as the only two who know. That's $284,000. If your terminal vendor says no, drop line 05 and nothing else moves. We'd leave the help desk calls for next year, once the phishing results tell you whether they're worth it.

      Terms in plain words.

      1. Fixed price for the scope you sign. Nothing is billed by the hour, and nothing is added without your written yes.
      2. Three payments. 40 percent at kickoff, 30 percent at the midpoint, 30 percent at the readout.
      3. Stop any time. If you halt for good, you pay for the weeks run plus a report on what we found so far.
      4. Rules first. You and Jonah sign the rules of engagement before anyone starts. Changes happen in writing only.
      5. Insured for you. $10 million in professional and cyber liability cover, with Ostler named on the policy.
      6. Your findings are yours. We delete our working copies 90 days after the readout and keep only the signed rules and the invoices.
      7. One fix review included. Four weeks after the readout we retest every fix. A second review is $9,000.
      8. Checked people. Background checks for all four operators, shared with you before kickoff.

      Three things we haven't settled.

      Each one could move a single line. None moves the base.

      Will your terminal vendor agree?

      Their contract has to allow testing of their VPN into your network. We need their written yes by week 5. If it doesn't come, line 05 drops, the price falls by $22,000 and the plan loses a week.

      Owner, Mara with your vendor manager

      Does the landlord's guard company need to know?

      Lobby security at Fenwick Street belongs to the landlord. We'd tell their site manager only, in a sealed letter, so a guard who stops Dez calls Jonah and not the police.

      Owner, Jonah, by kickoff

      Does your sponsor bank expect notice?

      Some sponsor agreements ask to hear about testing near card data. Your counsel will know. We've drafted the notice either way, so it costs a day at most.

      Owner, your counsel, by December 18

      Sign the rules and we start January 11.

      This proposal holds until December 4, 2026. Signing here accepts the scope below and the rules of engagement that come with it.

      Rules of engagement, PL-2611