Project description
We are preparing to launch a web application that will process sensitive user data, and before going into production we need an independent security assessment from an external specialist. This is not about general server hardening or firewall setup — we need a targeted pentest of the application itself with coverage of the full OWASP Top 10 list: injections, broken authentication and session management, broken access control, cross-site scripting, insecure direct object references, security misconfiguration, sensitive data exposure, and other categories. It's important to us that the tester thinks like a real attacker and checks the application the way an adversary would.
The work should combine manual testing and scanners, because automation alone misses logic errors and authorization defects. We will provide a test environment, two or three accounts with different privilege levels, and a brief overview of the main scenarios. In return, we expect a clear written report: each finding is described with reproduction steps, severity level (for example, by CVSS), real impact, and practical remediation advice that our developers can work with. We ask that you separate confirmed vulnerabilities from low-confidence observations so we can prioritize correctly.
After we address the findings, we'll need a retest: to confirm that each item is actually fixed and that no new issues have appeared. Confidentiality is mandatory — everything found stays strictly between us, data from our systems is not copied anywhere. Please describe your methodology, standards you follow, and an estimated timeline for the audit including retest.
What matters most to us:
— Full OWASP Top 10 coverage, manual work plus automation
— Report with severity levels and remediation recommendations
— Mandatory retest to confirm fixes
The work should combine manual testing and scanners, because automation alone misses logic errors and authorization defects. We will provide a test environment, two or three accounts with different privilege levels, and a brief overview of the main scenarios. In return, we expect a clear written report: each finding is described with reproduction steps, severity level (for example, by CVSS), real impact, and practical remediation advice that our developers can work with. We ask that you separate confirmed vulnerabilities from low-confidence observations so we can prioritize correctly.
After we address the findings, we'll need a retest: to confirm that each item is actually fixed and that no new issues have appeared. Confidentiality is mandatory — everything found stays strictly between us, data from our systems is not copied anywhere. Please describe your methodology, standards you follow, and an estimated timeline for the audit including retest.
What matters most to us:
— Full OWASP Top 10 coverage, manual work plus automation
— Report with severity levels and remediation recommendations
— Mandatory retest to confirm fixes
Web programming Cash, Bank transfer
