ispir/gök
Start a conversation

Independent security research

Small team.
Serious about
security.

We investigate how systems can fail.
Then make the findings clear.

A student-led initiative in Munich, working on scoped security assessments, independent research, and technical reporting.

Work with us Explore our approach
Fig. 01 / Inside the assessment
From attack surface to verified findings An illustrative penetration testing and audit map. Requests travel from a web entry point through an API and identity checks to a data store. Code review and testing produce evidence, then a report. Dashed lines mark the agreed testing scope. AGREED SCOPE ATTACK SURFACE HTTPSAUTHQUERYREVIEWVERIFY WEB ENTRYAPIIDENTITYAccess controlsDATA STORECODE AUDITFINDINGREPORT TRACE. TEST.REPRODUCE.
Trace the attack surface. Verify the finding.Illustrative
Munich, GermanyFounded by Orkun & ÖnderStudent led. Independently operated.

01 The initiative

Independent security
research, from Munich.

ispir/gök is a small security research initiative founded by Orkun Ispir and Önder Gök, two TUM students based in Munich.

We bring a focused, practical approach to understanding security risks: investigate carefully, document the evidence, and explain what it means for the people building the system.

The initiative is built to sustain ongoing research. Fees support the time and tools behind the work, while keeping the team small and the communication direct.

Independently operated. No official affiliation with the Technical University of Munich.

02 How we work

Understand. Test. Explain.

A clear process, from the first conversation
to the final handover.

Engagement / working model
Agreed scope
01
Context & boundariesThe question we are here to answer.
02
Investigation & evidenceWhat happens. Why it matters.
03
Findings & next stepsA useful technical handover.

Start with a shared understanding of the system and its boundaries.

Every assessment starts with an agreed scope and written permission.

03 What we do

Focused work.
Useful outcomes.

Three ways to work together,
shaped around a clear question.

01 / Assessment

Scoped security assessments

Focused investigation of a defined application, API, or component. We agree the objectives and boundaries together, then examine the areas relevant to that scope.

Working output

A scoped assessment brief, documented findings, and practical recommendations.

02 / Research

Independent research

Small, focused investigations into how software systems fail. A space for deeper technical questions, responsible disclosure, and shared learning.

Working output

Research notes, reproducible observations, and a clear explanation of the result.

03 / Reporting

Technical reporting

Structured documentation that connects an issue to its evidence, impact, and the steps needed to address it. Written for the people who need to act on the findings.

Working output

A readable technical report with reproduction details and prioritized next steps.

04 The people

A direct line to the people
doing the work.

Two founders. Shared curiosity.
Personal responsibility for the work.

05 Start a conversation

Something worth
a closer look?

Tell us what you’re building, what you want to understand, and the scope you have in mind.

Get in touch
Assessments · Research · Collaboration