A cybersecurity specialist attacks your app by hand following OWASP: sign-in and sessions, roles and other users’ data, the API, payments. A report by risk level, a retest and a letter for security questionnaires and your auditor. Only your app, with your written permission and without harming data.
We agree the scope and the testing window in the project chat.
01
SCOPE AND WINDOW
↖︎
You give a link and permission.
At checkout you confirm you own the app or have the owner’s written permission.
WRITTEN PERMISSION
02
✓Sign-in and sessions
✓API — 50 endpoints
!Other users’ orders
A MANUAL ATTACK
A specialist attacks by hand.
Following OWASP: sign-in and sessions, roles and other users’ data, the API, payments and files — without harming data.
WITHIN 10 BUSINESS DAYS
03
REPORT AND LETTER
You get the report and the letter.
Every finding with its risk level, steps and a recommendation; a letter for security questionnaires. One retest of the fixes within 14 days.
ONE RETEST — 14 DAYS
WHAT YOU GET
A report you can show an auditor.
For your customers’ security questionnaires, SOC 2 and ISO 27001 — evidence of independent testing. Whether it is enough is your auditor’s call.
01
A report by risk level
Every finding with its risk level, location, steps to reproduce, evidence and a recommendation for the fix.
02
A letter for security questionnaires
Scope, dates, method (OWASP WSTG, ASVS level 1), findings by risk level and their state after the retest. It is not a certificate.
03
A retest of the fixes
Once you fix them, the specialist checks every finding again and its state is updated in the report and the letter.
HOW WE WORK
Independent. With your permission.
Tested by someone who did not write your code — and only within the agreed scope.
01
Who tests
A cybersecurity specialist who did not write your code. We agree the scope and the testing window with you in the chat before it starts.
INDEPENDENT OF THE DEVELOPER02
Your permission
Only your app and only with your written permission — you confirm it at checkout.
PERMISSION FIRST03
Non-destructive
No denial of service, no mass mailing and no access to real customer data beyond what is needed to prove a finding.
NO HARM TO DATA
A SAMPLE FINDING
A finding you can fix.
A fictional finding as it comes in the report. With the report comes a letter for security questionnaires and the auditor: scope, dates, method and the state after the retest.
Sign-in and sessions: can the password be bypassed or a session taken over
Roles and other users’ data: up to three roles
The API — up to 50 endpoints
Payment and business logic
A report by risk level and a letter for security questionnaires
One retest; each next platform another $990
Security every month? In the subscription “Your QA team without hiring” vulnerability testing comes every month, with a letter for your customers’ security questionnaires. Plans ↗︎
Compare in detail
THREE STEPS
From keys in the code to a manual attack.
The express audit and vulnerability testing are not a pentest: they are non-destructive testing of the most common holes. A pentest is a manual attack following OWASP.
Express audit, vulnerability testing or a pentest
Express security audit
Vulnerability testing
Pentest
Access
No passwords or access — from outside
Test accounts for the roles
Test accounts, up to three roles
What we do
Keys in the code, database rules for an anonymous user, admin and API without sign-in, service files, outdated components, headers
Database rules, keys in the code, admin and API — and from inside: other users’ data and files under another role, forged payments, limited password guessing
A manual attack following OWASP (WSTG, ASVS level 1): sign-in and sessions, roles, the API up to 50 endpoints, payment logic, files and secrets
Report
Findings with risk level, steps and AI prompts; one retest
Every vulnerability with steps, a screenshot and an AI prompt; one retest
By risk level with steps and recommendations; one retest
Timing
Within 2 business days
Within 5 business days of the test plan
Within 10 business days of the agreed window
Price
$149 per app
$349 per app
$990 per platform
All three only on your app and with your written permission: no denial of service, no mass mailing, no access to real customer data beyond what is needed to prove a finding.
21 OCTOBER 2026
Two incidents in one day.
Even teams with security staff get hit. These happened in other services; outdated components and keys in your app’s open code are what the express audit looks for.
Yes, if the app is yours or its owner gave written permission — you confirm this at checkout. We test only your app and never touch third-party systems.
How is vulnerability testing different from a pentest?
Vulnerability testing is non-destructive testing of the most common holes in apps. Deep security testing (a pentest) is a manual attack following OWASP within an agreed scope and window, with a report by risk level.
Will you break my live app?
No: the testing is non-destructive — no denial of service, no mass mailing. For deep security testing we can work on a test environment; we agree it in the chat.
Do you need access to the code?
No. We test from the outside, like a hacker. You add test accounts for the roles in the project’s secure field, not in the chat.
Do you guarantee full security?
No. No testing can guarantee there are no vulnerabilities: we find and describe what we found within the agreed scope.
How is the express audit different from the free review?
The review shows how many risks are visible from outside and the most important one. The express audit gives the full list: where each finding is, how to check it, an AI prompt to fix it and a retest — and it looks deeper, for example at the database rules for an anonymous user.
Is it enough for SOC 2 or ISO 27001?
The pentest report and the letter are evidence of independent security testing that customers’ questionnaires, SOC 2 and ISO 27001 ask for. We do not certify and do not promise that an auditor accepts this scope: the scope, dates and method (OWASP WSTG, ASVS level 1) are in the letter, so the auditor can judge them.