Assessment sequence
Not every applicant moves through every step in the same way. The overall path looks like this:
- Apply — Submit your application with skills, experience and availability.
- Profile review — SafeYourWeb reviews whether your background and evidence look relevant.
- Verification — Identity verification, police verification, professional checks and compliance checks establish a trust baseline before assessment continues.
- Knowledge assessment — A structured check of security fundamentals and track-specific concepts.
- Practical Safe Lab — Hands-on work in intentionally vulnerable or SafeYourWeb-controlled environments.
- Report writing — You document findings with evidence, impact and remediation guidance.
- Technical interview — A discussion of your approach, judgment and communication.
- Supervised work — Where required, supervised delivery helps confirm real-world readiness.
- Final approval — Activation depends on successful assessment, verification and program approval.
Practical Safe Lab
Practical assessment happens only in intentionally vulnerable labs, SafeYourWeb-controlled environments or other clearly defined test environments with written scope.
Applicants must never be asked to test arbitrary third-party systems. If something is not in the written lab or engagement scope, it is out of bounds.
Depending on your track, you may be asked to:
- Find security issues in the supplied environment
- Validate findings before reporting them
- Collect safe, non-destructive evidence
- Explain impact and affected components
- Suggest fixes
- Retest a supplied fix
- Write a professional report
Other tracks may use different practical formats, for example:
- Blue team / SOC — review synthetic logs, classify alerts, build a timeline and propose containment steps
- Proxy / WAF — review sample HTTP flows, design policy decisions and explain false-positive risk
Report writing
A good security report helps someone understand the issue and act on it. SafeYourWeb looks for clear writing, solid evidence and scope discipline.
A useful finding usually includes:
- Clear finding — what the issue is, in plain language
- Evidence — enough proof to show the issue is real
- Impact — what could go wrong if it is exploited or left unfixed
- Risk — how serious it is in context
- Remediation — what the customer should do next
- Scope discipline — stay inside what you were authorized to test
- Clear communication — readable by technical and non-technical readers where needed
Example of a clear finding summary:
“An authenticated user can access another user’s invoice records by changing the invoice ID in the API request. Evidence shows the API does not check ownership. Impact: exposure of customer billing data. Suggested fix: enforce object-level authorization on the invoice endpoint and add tests for cross-user access.”
Technical interview
The interview is a conversation about how you work. It is not designed as a set of trick questions.
You may be asked things like:
- Explain a security project you worked on end to end.
- How do you verify a finding before you report it?
- What do you do when you find something outside scope?
- How do you prioritize findings?
- What would you do if sensitive data appears during testing?
- How would you explain a serious issue to a non-technical customer?
- What would you do if production becomes unstable during authorized testing?
SafeYourWeb is looking at:
- Technical knowledge
- Judgment
- Communication
- Responsible behavior
Verification and approval
Verification is how SafeYourWeb confirms who you are and whether you meet the trust standards required for authorized security work. It sits alongside technical assessment — both matter before you can be activated as a Captain.
Exact steps can vary by program requirements and the type of work you may be eligible for. In general, verification may include:
- Identity verification — Confirming your legal identity with documents and details you provide, so SafeYourWeb knows the person applying is the person who will perform the work.
- Police verification — A background / police verification check used as part of the trust baseline for Captains who may access sensitive systems and customer environments. You may be asked to complete or submit police verification (or an equivalent local background check) as required for your region and engagement type.
- Professional checks — Review of experience claims, references or other professional evidence where needed to support your application.
- Compliance checks — Confirming you can meet program policies around confidentiality, authorization, reporting and responsible security behavior.
Police verification and other background checks are not a substitute for technical assessment. They help protect customers and the network when Captains are trusted with authorized access. If a required verification step is incomplete, delayed or unsuccessful, activation can be held or declined even when technical skills look strong.
Final activation depends on successful assessment, verification and program approval. Technical strength alone is not enough if authorization behavior, honesty or confidentiality standards are not met.
What matters most
Unsafe authorization behavior, dishonesty, confidentiality violations or an inability to follow scope can stop activation even when technical skills look strong.
Next: skills and specializations, or read how projects and rules work after you join.