Security & Privacy
Cloud Access Permissions Audit
Every user and role in your cloud account checked against what it actually uses, with excess permissions removed safely.
₹20,999
Web Application Penetration Test
A hands-on penetration test of your web application, with evidence for every finding and a free retest after you fix the issues.
- Timeline
- 12 working days
- Deliverables
- 7 listed
- Fixed price
- ₹32,999
What this service delivers
Automated scanners catch the obvious problems and miss the expensive ones, such as an endpoint that reveals someone else's invoices once an ID in the address bar is edited. This test is performed manually against the common classes of web application weakness and against the business logic specific to your product, from the position of an attacker who already has a valid login. Every finding includes reproduction steps and evidence, so your developers can start fixing rather than debating.
Deliverables 7 items
What you receive
- Manual testing of login, permissions and business logic
- Coverage of common web vulnerability classes plus API-specific checks
- CVSS severity scores, with reproduction steps and evidence
- Access control testing across every user role
- Executive summary for non-technical readers
- Remediation advice specific to your system
- Free retest within 30 days, with a summary letter you can share with customers
How the work runs, in 4 steps
-
Step 1: Scope
Roles, environments and testing limits are agreed in writing
-
Step 2: Test
The application is tested manually from each role's point of view
-
Step 3: Report
Findings are documented, scored and explained to your developers
-
Step 4: Retest
Fixes are checked and the summary letter is issued
Who it suits, and what we need from you
Ideal for
- Products handling payment, health or personal data
- Companies asked by an enterprise customer for a test report
- Teams that have never had an external security review
What we need from you
- Test accounts for every role, on staging or a production-like environment
- Written permission to test from someone authorised to give it
- A developer we can contact quickly about critical findings
You share these through the brief in your account after checkout.
What changes for your team
-
01
Weaknesses are found and fixed before attackers find them
-
02
A report you can share with customers or auditors
-
03
Fixes are verified, not simply assumed
Questions about this service
We prefer to test on staging or a production-like copy. If production is the only option, we agree safe limits and timings first.
We contact your nominated developer straight away rather than waiting for the final report.
This is a remote technology service, so nothing is shipped physically. Work is delivered into systems you control. Read delivery and handover and refunds and cancellation for the full terms.