We safely observe a public digital service, report what we find privately to the people who run it and help them fix it. Monitoring runs for the free program period.
ForGovernment bodies across Africa · Parastatals and public institutions · People responsible for essential public digital services
- 01Referral receivedA public permit portal may be exposedFrom the public
- 02Safe observationWe look only at what anyone can seeNo loginNo changes
- 03Private reportSent to the team that runs the servicePrivate
- 04Fix and checkThe owner fixes it. We check it together.Monitoring on
- Price · USD
Free$0 · No charge
We confirm eligibility before we start.
- Term
Free period
Dates agreed with the owner
- Monitoring
Included
For the full free program period
- Best for
African public institutions
Free public-service protection
How it works
How a referral becomes a fix.
We review and coordinate in order of risk, and monitor the service for the free program period. Scope and timing depend on public impact, the owner's engagement and our capacity.
- 01
Someone refers a service.
Anyone can flag a public service they think is at risk. We can also find one ourselves.
A government or parastatal service in Africa, nominated to us or visible to the public
- 02
We look from the outside.
We check only what anyone can see from the internet. A referral is not permission to log in.
Safe observation of internet exposure and risks to the service
- 03
We tell the owner privately.
Serious findings go to the people who run the service, never to the public.
Private reporting to the institution that runs it
- 04
We help fix it, then check.
We work with the owner on the fix and confirm it worked.
Help coordinating fixes and checking them with the system owner
- 05
We keep watch.
With the owner's agreement, we monitor the service for the free period.
Ongoing monitoring of the service for the free program period, with alerts sorted and sent to the owner's contacts
Private exposure report
Permit portal
- To
- The team that runs the service
- What we saw
- An admin login page open to the whole internet
- Why it matters
- Anyone can try passwords against it
- Suggested fix
- Allow access from staff networks only
- What we did
- Looked from outside. We have not logged in or changed anything.
Our rules
The rules we never break.
Public services hold people's data and keep daily life running. We treat them with care.
- 01
Public Infrastructure Security is free and needs no commercial contract. We weigh each referral against our priorities and capacity.
- 02
A service being public, or referred by someone else, does not give us permission to exploit it, log in or change it.
- 03
No destructive testing, denial of service, persistence, social engineering or needless access to personal data.
- 04
Monitoring covers the systems and signals we agree, for the free program period. We write down methods, triage hours and escalation times before it starts. Monitoring does not guarantee that an incident will be contained.
We publish the full principles behind this work.
Read the principlesFor the owner
What the institution gets, at no cost.
For public digital services run by governments, parastatals and public institutions across Africa.
A private exposure report with evidence
What we saw, with the evidence, sent only to the owner.
Fix guidance in priority order for the institution
What to fix first, written for the team that runs the service.
Notes confirming which fixes worked
A record of which fixes we checked and how.
Monitoring findings, alerts we raised and next actions for the free program period
Alerts and next steps for as long as the free period runs.
What we ask of the owner
- 01The institution, country and public service
- 02The best contact you know for the service
- 03Written permission from the owner before any logged-in or intrusive testing
- 04An owner who can make the fixes
- 05Monitoring access or data feeds, alert contacts and who to call when something is urgent
Questions about referrals.
Does a referral give you permission to test?
No. We can safely observe what is public. Logged-in or intrusive work and any change to a system need written permission from the owner.
What does it cost the institution?
Nothing. Accepted Public Infrastructure Security work costs $0 and needs no commercial contract.
Who can refer a service?
Anyone who knows of an essential public service at risk. We contact the institution that runs it before any further work.
Is ongoing monitoring included?
Yes. We monitor the service for the full free program period. We agree access, reporting, contacts and triage hours with the owner before it starts.
Public Infrastructure Security · Free
Know a public service at risk? Tell us.
Tell us the institution, country, service and best contact. Our team reviews the referral and reaches out to the owner.