Secrets and Dependency Hygiene Sprint
We locate credentials committed to your repositories, rotate them safely and add scanning so new leaks are blocked.
Full version history secret scan across up to 20 repositories
₹12,999
Web Application VAPT
A hands-on penetration test of your web application, with proof-of-concept evidence for every finding and a retest once fixes land.
Overview
What this engagement is
Scanners are good at the predictable and poor at the dangerous. They rarely notice that a logged-in customer can open someone else's invoice simply by editing an ID in the address bar. This engagement is a manual assessment led by a tester working with genuine credentials and an attacker's curiosity, covering the OWASP Top 10 and the business logic unique to your product. Each issue arrives with evidence and exact reproduction steps, so engineering time goes on fixing rather than debating. Once remediation is done we retest at no charge and issue a summary letter you can share with customers who ask.
Deliverables
What you receive
- Hands-on penetration test of authentication, authorisation and business logic
- Full OWASP Top 10 coverage alongside dedicated API testing
- Every finding scored with CVSS and supported by evidence and reproduction steps
- Access control testing across each user role in your application
- Executive summary written for leadership and non-technical stakeholders
- Remediation advice tailored to your stack rather than boilerplate
- One complimentary retest within 30 days and a customer-ready summary letter
Outcomes
What changes once it ships
Exploitable weaknesses surface on your terms, not an attacker's
A credible report to hand to customers, auditors and procurement teams
Remediation confirmed by retesting instead of taken on trust
Process
How the 4 stages run
Scope
Targets, roles, test accounts and rules of engagement are agreed in writing
Test
Several days of manual testing, with anything critical escalated to you straight away
Report
Findings documented with evidence, severity and practical remediation steps
Retest
Your fixes are verified and the report reissued once your team signals it is ready
A strong fit for
- Products that process payments, health information or personal data
- Businesses whose enterprise prospects have requested a penetration test report
- Teams that have not yet had an independent security assessment
What we need from you
- Test accounts for each role on staging or an environment close to production
- Signed written authorisation from someone with the authority to grant it
- A developer we can reach quickly if a critical issue needs urgent attention
You share these through the brief that opens in your client dashboard once payment is confirmed. The timeline starts when they arrive.
Answers
Questions about this engagement
We prefer staging. If production is the only option, we agree tight limits and timings in advance and avoid anything destructive.
It is structured the way auditors and enterprise security reviewers expect for SOC 2, ISO 27001 and vendor due diligence.
You receive that conclusion in writing, which carries its own value. It does happen, although seldom on a first engagement.
This is a digital service — nothing is shipped. Work is delivered to the timeline above, into systems you control, and our refund terms explain what happens if a date is missed.
Often paired with
Engagements that work well alongside.
DPDP Act Readiness Review
A hands-on gap assessment against India's DPDP Act 2023, covering consent, retention, notices and your breach response.
Inventory of personal data across systems, vendors and storage locations
₹22,999
SOC 2 Evidence Groundwork
We put in place the technical controls and evidence collection a SOC 2 Type II audit expects, before your observation window opens.
Control gap assessment against the Trust Services Criteria in your scope
₹44,999