Full web app pentest

A manual penetration test of one agreed web application and its in-scope API surface.

£999Fixed price for an agreed small-application scope, with one verified retest.

What gets tested

Authentication and sessions Account controls
Authorisation and object access Roles + records
Injection and unsafe input App + API
Data exposure and configuration Runtime surface
Business-logic abuse Agreed workflows

What you receive

A manual test report with reproducible evidence, severity, impact and practical remediation guidance.

Written rules of engagement
Evidence-led vulnerability report
Technical findings debrief
One retest of agreed priority fixes

Penetration testSample structure

Account record accessible across usersHigh severity · reproduced manually

Cross-account request rejectedVerified during retest

Security test report beside a hardware security key

Scope and limits

Included

One small web application
One production-like environment
Agreed user roles and API surface

Excluded by default

Denial-of-service testing
Social engineering and physical access
Third-party systems without permission

Authorisation first

Testing starts only after ownership, written permission, targets, exclusions and timing are agreed. A Git repository is optional unless source-assisted testing is in scope.