Web Application Pentest - Comprehensive

Fixed price. Fixed scope. No sales call. Our most thorough web application test, for multi-tenant SaaS platforms and applications with complex role models, payment flows or extensive APIs.

Scope included

• 1 web application (single primary domain) including its backend API
• Up to 6 user roles tested, including privilege-escalation between roles
• Up to 150 API endpoints / dynamic pages
• Multi-tenant isolation testing (tenant-to-tenant data access)
• Estimated effort: 7 tester-days

What we test

• OWASP Top 10 and OWASP API Security Top 10
• Authentication, SSO/OAuth flows, session management and access control
• Business-logic flaws, including payment and workflow abuse
• Input handling: injection, XSS, SSRF, file upload, deserialization

Deliverables

• PDF report with executive summary and technical findings (CVSS-scored, with reproduction steps and remediation advice)
• 1 free retest within 90 days of the final report: we verify your fixes and issue an updated report
• Letter of attestation you can share with auditors and customers
• Critical findings reported to you immediately, not at the end of the test

Not included

• Social engineering / phishing, denial-of-service, physical testing
• Mobile apps, infrastructure/network testing, source-code review

Larger than this? Buy an additional tier for a second application, or email us and we'll reply with a fixed price, not a sales call.