Penetration Testing (Network + Web Application) for Amazon SP-API Compliance — Azure

Overview We're a software provider integrating with Amazon's Selling Partner API (SP-API) and are completing Amazon's Data Protection Policy security audit. We need two penetration tests performed by a qualified, independent tester, with reports that will be submitted to Amazon's reviewers. Automated scan output alone (e.g., ZAP, Nessus) will not satisfy this requirement — manual testing by a credentialed professional is required. Engagement 1 — Cloud / Network Penetration Test Scope: Azure VNET and private subnet configuration review Network segmentation validation External perimeter testing of internet-facing assets Report must contain: tested assets, test dates, methodology, findings with severity ratings, remediation recommendations, and retest status. Engagement 2 — Web Application Penetration Test (https://app.urbanseller.net) Scope: Front-end application Back-end API (REST / GraphQL) Authentication & authorization mechanisms, including OAuth 2.0 / Login with Amazon token issuance, refresh, storage, and rotation Business logic testing Methodology: OWASP (WSTG / Top 10) Report must contain: client name, tested URLs/endpoints, test dates, methodology, findings with severity ratings, remediation recommendations, and retest confirmation. Environment Small Azure footprint — web/UI front end, REST API back end, one SQL database, one storage account. Full technical details and scoped access provided to the selected tester under NDA. Required qualifications Recognized certification: OSCP, CREST, and/or GPEN Independent third party (no affiliation with our organization) Demonstrated manual penetration testing experience (not automated-scan-only) Strongly preferred: prior experience producing pen test reports accepted in Amazon SP-API / Data Protection Policy audits Deliverables Two formal reports (network + application) meeting the content requirements above, each with an executive summary A remediation retest and updated/confirmed report after we address any findings