External CREST/CHECK penetration test — two-app NHS digital health platform (DTAC v2 evidence)

Overview We need an external, CREST/CHECK/Tiger Scheme-accredited penetration test and formal report to satisfy the technical security section of an NHS DTAC v2 submission (mandatory as of April 2026 — external manual testing, documented findings, retest of Critical/High issues). The platform has two components in scope: 1. Patient-facing information app — presents clinical pathway content only. No accounts, no patient login, no PII/PHI stored or transmitted. Anonymous, unauthenticated by design. 2. Clinician-facing staff shell — the only credentialled surface in the system. Authenticates staff/clinician identity for content sign-off workflows. No patient PII/PHI ever passes through it either, but it does have login, roles and an authorisation model that needs proper attack coverage (auth bypass, privilege escalation, session handling, IDOR, etc.). Both share the same backend/CMS and hosting infrastructure. Technical stack • Next.js (App Router, React Server Components) on Vercel • Headless CMS (Sanity) accessed via server-side tokens; clinician app uses its own authenticated API surface • TLS managed by host • No payment flows, no ad-tech/identity trackers Scope of work • Unauthenticated web app pentest of the patient-facing app. • Authenticated web app pentest of the clinician shell — multiple role levels if applicable, full auth/session/access-control testing. • Coverage aligned to OWASP Top 10 / ASVS: injection, broken access control, misconfiguration, secrets/token exposure, SSRF, dependency vulnerabilities, security headers, API/CMS surface. • Formal report: executive summary, methodology, CVSS-rated findings, evidence, remediation guidance — in a format usable as DTAC v2 evidence. • Retest of remediated Critical/High findings and updated attestation. Deliverables • Penetration test report (PDF), DTAC v2-ready. • Remediation retest + final attestation. Required • CREST, CHECK or Tiger Scheme accreditation — this is a DTAC v2 requirement, not optional. • Redacted sample report from a prior engagement. • Experience testing Next.js/Vercel or similar JAMstack + headless-CMS stacks, and apps with role-based clinician/staff auth. • Familiarity with NHS DTAC v2 / DSPT evidence expectations is a strong plus. • Written work in British English. To apply, include: • Confirmation of accreditation (CREST/CHECK/Tiger Scheme) with registration reference. • Redacted sample report. • Fixed price covering both apps + retest, and turnaround time. • Any prior NHS/DTAC engagement experience.