Website Security Review — Code Scan + Basic Penetration Test for Early-Stage Marketplace

I'm launching marketplace website with customer/vendor accounts, messaging, and Stripe-based vendor billing (no in-app payment processing between customers and vendors). I'd like a security review before going live. Scope: Static code scan for common vulnerabilities (exposed secrets/API keys, insecure dependencies, known vulnerable patterns) Basic web application penetration test covering authentication/authorization (login, account access, admin portal), input validation (forms, messaging, search), and data exposure risks (e.g., customer/vendor personal info, order data) A written report of findings, prioritized by severity, with clear remediation guidance Not in scope right now: load/stress testing, compliance certification (PCI/SOC2/etc.), infrastructure/network testing. Important: I'm looking for genuine manual testing, not just results run through an automated scanning tool. I've been told automated-only scans can be unreliable and miss real vulnerabilities, so please describe your actual testing process in your proposal, and how much of it is manual versus automated. What I'll provide: access to a staging environment (not production), relevant documentation on app structure, and availability for questions during the engagement. Please provide a fixed-price quote based on the scope above (not hourly), along with relevant experience, certifications (OSCP, GPEN, CEH, etc. a plus but not required for this scope), and a sample redacted report if available. Note: I'm also separately hiring for a security review of my iOS and Android apps. If you have experience with mobile app security testing as well, feel free to bid on both jobs, or mention your mobile experience here and I can discuss combining the engagements.