Manual Grey-Box Pentest — Web App + API (OWASP / ASVS L2)

Annual authenticated grey-box penetration test of our B2B SaaS web app and APIs. Results must be shareable with our enterprise customers under NDA. **Scope** (production-identical staging) - Web app, REST API, WebSocket endpoints. Size: ~28 pages, ~286 APIs, 1 gateway, 2 roles across 2 tenants. - RBAC and cross-tenant isolation (IDOR). - AI natural-language-to-SQL feature: prompt injection, SQL injection, data exposure. - Geocoding integration, file import/export, auth flows (SSO/MFA, password reset, tokens). - Out of scope: DoS, social engineering, physical. **Requirements** - Manual testing (not scanner-only). Standards: OWASP Top 10, OWASP API Top 10, ASVS L2, NIST SP 800dash115. - Every finding scored CVSS v3.1 with full vector. Lead tester holds OSCP/CREST/GPEN, named in report. **Deliverables** 1. Technical report: per finding — CVSS + vector, OWASP category, affected URL/param, impact, reproduction with evidence, remediation. 2. Signed executive attestation letter (1–2 pp, your letterhead) — **no clause restricting third-party disclosure** (we share it with customers/prospects under NDA). 3. Retest letter after fixes (also externally shareable). 4. Findings export (CSV/XLSX). **Timeline & terms** - Results by **30 August 2026**. Draft report within 5 business days of start; retest letter within 5. - Retest included in price. NDA before start; no retention of our data.