Web & API
Penetration Testing
Find vulnerabilities in your application before attackers do.
Manual testing of web apps and APIs. Fixed price after scoping. Retest always included.
Engagement Model
Engagement options
Every formal web and API pentest I conduct strictly follows the OWASP Testing Methodology. You receive a rigorous, compliance-ready report to confidently share with your customers and stakeholders.
Option A
Official Penetration Test
Best for compliance, vendor audits, and major deployments.
- Priced in advance from the approximate size of the application
- Higher cost, with a dedicated testing window booked ahead
- Needs planning so testing time can be allocated
- Rigorous, methodology-backed report you can share
Option B
Fast-Track Consultation
Best for active development and quick reviews.
- Fast and ad-hoc, with quick response
- Billed by the hour, very flexible scope
- Backed by immediate NDA signing
- Simple, read-only system access
Scope
What's in scope
Browser-facing web applications and the APIs behind them. We confirm which of these apply during scoping.
Web Applications
Authentication bypass, broken access control, XSS, SQL injection, and business logic flaws in browser-facing apps.
REST APIs
Auth bypass, BOLA, BFLA, injection, mass assignment attacks.
GraphQL
Introspection abuse, batching attacks, authorization bypasses, complexity limits.
WebSocket APIs
Message injection, CSRF, authentication persistence, per-message authorization checks.
Microservices
Service-to-service trust, gateway bypass, JWT flaws. On request.
Requirements
Access and accounts I need
For web applications: the URL and one test account per role. A non-production environment is preferred.
For APIs: or equivalent REST documentation. If none exists, I treat it as an undocumented API and scope accordingly.
What does each endpoint do? What business process does it support? What data does it handle?
List every user role and what each can access, modify, create, and delete. Example:
Which data is isolated per organisation or user? What must never cross tenant boundaries?
- › Non-production environment access
- › One test account per role (pre-created)
- › Sample test data that can be safely manipulated
Why role definitions matter
Authorization flaws (BOLA, BFLA) are the most common critical findings in API testing. I find them by knowing what each role should access - then proving it can access things it shouldn't.
Without a role matrix, I spend time guessing your access model instead of testing vulnerabilities. That time increases the price.
A well-structured OpenAPI spec + role matrix = I test vulnerabilities, not map your API. Undocumented or non-standard API = additional discovery work → reflected in the final quote.
Pricing
Indicative pricing
There is one offering - a full web and API pentest. The price depends on the scope we define together. Final quote issued after a free scoping call.
What affects the final price
Application & API Surface
Number of pages, endpoints, roles, and protocols (web, REST, GraphQL, WebSocket). More surface = more time = higher price.
Documentation
Swagger / OpenAPI spec significantly reduces scoping time. Undocumented APIs require more reconnaissance and are priced higher.
Saves money
Lead Time
Booking a slot at least 3 weeks in advance allows better planning and is reflected in the quote. Urgent engagements carry a premium.
Process
How We Collaborate
We review your API docs, role matrix, and architecture. I issue a fixed-price quote. No surprises.
You provide non-production access and one test account per role. I confirm scope and rules of engagement.
I test your API against the OWASP API Top 10 and custom scenarios derived from your role matrix and business logic.
Executive summary for management. Technical findings with reproduction steps and remediation guidance for your dev team.
We walk through findings together. After you remediate, I retest every finding at no extra charge.
A one-off assessment answers a single question. A Retained Security Partner retainer schedules these assessments for you at the best time and budget, so testing keeps pace with how your business changes.
Scope a test
Start with a free 30-minute scoping call. I'll tell you what I need, what I'll test, and what it will cost - before you commit to anything.
Prefer a steady monthly rhythm over one-off invoices? See the Retained Security Partner retainer.
