Senior pentest without theater.

// Who signs

The person behind every report.

I’m Gabriel L. Ferreira, founder and lead pentester at RET Tecnologia. I spend my days looking at production SaaS the way an attacker would: hunting for where login, billing, permissions, and data can turn into loss, exposure, or a blocked B2B sale. RET exists because building products with AI got fast — and reviewing what was built fell behind. I don’t come from security marketing; I come from breaking things with authorization and explaining, in plain language, what it costs. Every report carries my name because that’s how I trust my own work.

How I work

The path

1. Roots

   Research and responsible disclosure

   I started in offensive security and research, reporting real flaws with minimal evidence and accountability. That’s where it became clear the problem is rarely an exotic exploit — it’s loose access control, a poorly drawn boundary, and a payment flow that trusts the client.

2. Focus

   The AI-built SaaS gap

   Vibe coding made the MVP appear in days. But login, per-customer isolation, checkout, and permissions are still the part nobody reviews before selling. RET was born to close exactly that gap, with a human eye where automated tooling can’t reach.

3. Method

   The Cascavel Framework

   I organized my way of hardening products into what I call Cascavel internally: a forensic hardening method that treats the application as a surface to be armored in layers — containment, isolation, and verification — instead of a generic checklist. It’s the backbone of every review and of how RET’s own site is built.

4. Ladder

   An honest product ladder

   Instead of selling pentest to everyone, I built a ladder: Promptbook for the first paid review, AuditMySaaS to watch what changes, Risk Review for the human read that decides, and Manual Pentest to prove what breaks. Each rung escalates only when risk asks for it.

5. Proof

   Find My SaaS, in public

   On Find My SaaS I reported three real flaws — an S3 upload, an inflatable metric with 564 simulated clicks, and an invalid social login on a sensitive route — with a public fix and acknowledgment from Mano Deyvin. It’s the external proof the method works off the slide.

When it makes sense to call me

• Before closing a B2B sale that depends on the customer trusting your security.
• After a review or scan flagged a signal and you don’t know if it’s serious.
• Before opening the product to many more users, when the cost of a mistake grows with it.
• When a customer or investor asks for proof of security and you have nothing to show.

What guides me

I don’t promise total security — no one serious does. I promise to show what breaks, with evidence, priority, and a fix your team can actually apply. If your SaaS already has people paying, customer data, or a B2B proposal on the table, this is the moment to leave "it should be safe" behind.

If you want to see the work up close, the code and public research live on GitHub. To talk about scope, the path is the Pentest page.

If you’ve read this far, you probably already feel the product grew faster than its review. That discomfort is exactly what I help turn into clear priority, with evidence instead of guesswork.

Where to find me