Reverse engineering & automation
We take apart the app, the protocol or the protected page sitting on top of your data, then build the client nobody shipped. Written in Go and Python, deployed with enough proxies to survive a Monday.
$ GET /api/v3/undocumented
404 Not Found
No docs, no SDK, and the vendor's integration team will get back to you in Q3.
$ GET /api/v3/undocumented
200 OK
Signed headers, rotated exits, rows landing in your Postgres on a schedule.
Everything between those two lines
Nothing exotic. It is the same shelf every RE team works off. The job is knowing which one answers the question you actually have at 2am, and when to stop poking and write the client instead.
No discovery phase billing for three months before anyone opens a debugger.
Thirty minutes. What you need, what already exists, what it has to talk to.
A few days with the real target. Then a written answer: feasible or not, what it costs, where it will hurt later. Sometimes the answer is don't.
Short cycles. Each one ends in something you can run yourself and argue with.
Repo, infrastructure, docs, and a support window while it settles. Retainer optional, never a lock-in.
Two halves of one job. Get to the data or the endpoint, then wrap it in something still running six months later without you watching it.
Getting data out of places built to keep it in. The hard part is never the first request. It is request 400,000 on a Sunday, after the target quietly swapped its challenge.
The private API behind a mobile app, a desktop client, or a login flow with four layers in front of it. We map it, write down how it works, and hand you a client you own.
Drops and on-sales, where the whole product is what happens in the first four seconds and nothing after that counts.
Raw requests instead of a headless browser pretending to be a person. Same discipline on-chain, where every retry costs gas.
Services that stay debuggable at 3am, because 3am is when you will be reading their logs.
Somewhere to watch the thing run, kill a stuck task, and see why yesterday's batch came back short.
Deploys you can trigger on a Friday. And if the thing you are building is a product other people pay for, a gate around it that actually holds.
That is what the first call and the few days after it are for. We look at what is guarding it, then say what it takes to get in, what it costs to keep working, or that it is not worth your money. A few times a year that answer is no, and you get it before an invoice exists.
Anything aimed at systems that are not yours to automate: intrusion, credential theft, fraud, reselling data you have no right to. We work for clients operating inside their own agreements and rights. If a request sits on the wrong side of that, we say so on the call and that is the end of it.
Fixed price per project, quoted after we have seen the target. A quote written before that is a guess with a decimal point in it. Small integrations land nowhere near a full teardown, and you will never get a range like 3k to 300k from us.
Often. Rescues, rewrites and the-last-dev-vanished cases are normal here. You get an honest read on whether fixing it or restarting is cheaper, even when the answer is the boring one.
You get the repository, the infrastructure and the docs, all running on your accounts. Support afterwards is a choice, not a subscription you have to remember to cancel.
Karol takes the call. Not an account manager who writes your question down and comes back a week later with half of it.
status404 is small on purpose. Two or three projects at a time, so the person who wrote the parser is the one who answers when it stops parsing.
If your problem is not something we are good at, you will hear that on the first call, usually with a pointer to someone better.
— Karol, status404
Tell us what is blocking you and paste whatever you already have: a URL, a HAR file, an APK, a half-working script. You get a yes, a no, or a number. Usually the same day.
or email hello@status404.com