We provide pro bono digital security and safety consultations for the Stanford community. Hosted by Applied Cyber , the Clinic’s mission is to ensure

• the sensitive data entrusted to your company or product remains private and out of the hands of attackers,

• you understand — and are working to mitigate — the security risks your product or company faces, and

• you think clearly about the safety of your users and the potential for abuse.

The clinic meets by reservation on Mondays at 3:00pm PT. For the summer, we will be meeting virtually. To book a meeting, please visit our contact page .

What we do

A clinic meeting can vary, but typically involves:

• Threat modeling and infrastructure review — We’ll talk through your threat model, spanning both product security and — when applicable — corporate security. We’ll review your infrastructure and explore how you can minimize risk.

• Data security model consult — We’ll assess the potential attack surface, data model and means of data storage, and backend design of your app from a security perspective. We’ll then tell you what to focus on to safeguard sensitive data as you add features and grow your app.

• Live security testing — We’ll attempt to find vulnerabilities in your app that might enable an attacker to access sensitive user data, cost you money, or otherwise violate your security model. If we find issues, we’ll recommend ways you can remediate the vulnerabilities and secure your systems.

For applicable startups, we will also work with you to craft a safety model for your product. First, we’ll explore the specific harms and abuse your product might face, such as, spam, fraud, harassment, and stalking. Next, we’ll explore techniques to proactively mitigate these harms, ranging from automatic moderation systems to design changes. Finally, we’ll discuss how you can incorporate monitoring and observability into your stack to ensure that safety issues don’t catch you by surprise.

Note: A consult does not constitute an exhaustive security evaluation of your app. Rather, it represents a good starting point for the evolution of your service with the benefit of a security informed perspective.

About Applied Cyber

Founded in 2015, Applied Cyber is Stanford’s premier cybersecurity student group focused on teaching students practical skills in analyzing, exploiting, and defending computer systems.

Applied Cyber has had a strong track record of working with the Stanford entrepreneurial community to ensure that popular campus apps fulfill the data safety standards students trust them with. In recent years, we have found and disclosed dozens of security vulnerabilities to student startups and social apps and worked with them on fixes that protect student data.

Since 2020, Applied Cyber has also conducted authorized penetration tests of critical services within the Stanford University infrastructure. Engagement targets have included instructional support systems, Windows Active Directory, custom web applications, industrial and environmental control systems, and a smart home and IoT (internet of things) lab.

Over the past nine years, Applied Cyber competition teams have participated in over 80 cyber competitions, achieving top placements in more than 20 of them. Notably, we secured three consecutive National Championships in the Collegiate Penetration Testing Competition (CPTC) between 2017 and 2019, and attained third place in the National Collegiate Cyber Defense Competition (CCDC) in 2020 and 2022 before taking the championship title in 2023.