A firm. A research team. A peer review before mainnet.The second mind for the protocols that ship money.
I'm from Valencia, I work from Wrocław, and I started Zealynx because the audit I wanted to receive didn't exist.
Most security firms claim full-stack and deliver narrow. We split this firm in two so it's literally true: smart contracts is my desk, Web2 and AI is Fernando's. The senior who signs your report is the senior who read your code.
Forty-one published reports later, the discipline still comes down to one rule for me: refuse the jobs you can't kill. Take the ones you can finish. Publish what you're allowed to.
Two practices, one firm.
Fuzzing, formal verification, manual review. The discipline Zealynx was built on. Led by Carlos.
Application pentesting, AI / LLM / MCP security assessments, red team operations. The other half of full-stack. Led by Fernando.
Leading offensive security operations and red team engagements for enterprise clients. Advanced penetration testing, vulnerability assessments, and security architecture reviews.
Every engagement is delivered by the practice lead. No juniors. No subcontractors.
We do not stretch to fit
Engagements we cannot finish on our own bar, we do not take. Capacity is the wrong lens. Fit is the right one.
What we found, not how many
We report exploitable bugs and dangerous patterns. We do not pad mediums to make a histogram look diligent.
The auditor who signs ran the work
Smart contracts, Carlos. Web2 and AI, Fernando. The signature is a promise about who read the code, not a corporate stamp.
Everything we are allowed to publish, we publish
Forty-one reports live, including the ones we did not love. We would rather be fact-checkable than flattering.
A workspace, not an attachment
Findings, fixes, retests, evidence. One URL. Hand it to whoever audits you next. portal.zealynx.io →
Reports.
What we return to the ecosystem.
Zealynx Audit Grants
Zealynx Academy
Krait, open source
Growth.
Helps drive growth at Zealynx. Security researcher in his own time, so the first conversation is technical, not transactional.