iOS & Android App Security Review — Code Scan + Basic Penetration Test for Early-Stage Marketplace

I'm launching a marketplace with both an iOS app and an Android app, featuring customer/vendor accounts, messaging, and Stripe-based vendor billing (no in-app payment processing between customers and vendors). I'd like a security review of both apps before going live. Scope: Static code scan for common vulnerabilities (exposed secrets/API keys, insecure dependencies, known vulnerable patterns) across both apps Basic penetration test covering authentication/authorization (login, account access, admin portal), input validation (forms, messaging, search), and data exposure risks (e.g., customer/vendor personal info, order data) Mobile-specific checks for iOS and Android (e.g., insecure local data storage, improper API/session handling, certificate pinning where applicable) A written report of findings, prioritized by severity, with clear remediation guidance Not in scope right now: load/stress testing, compliance certification (PCI/SOC2/etc.), infrastructure/network testing. Important: I'm looking for genuine manual testing, not just results run through an automated scanning tool. I've been told automated-only scans can be unreliable and miss real vulnerabilities, so please describe your actual testing process in your proposal, and how much of it is manual versus automated. What I'll provide: access to a staging environment (not production) for both apps, relevant documentation on app structure, and availability for questions during the engagement. Please provide a fixed-price quote based on the scope above (not hourly), along with relevant experience testing mobile applications, certifications (OSCP, GPEN, CEH, etc. a plus but not required for this scope), and a sample redacted report if available. Note: I'm also separately hiring for a security review of my website. If you have experience with web application security testing as well, feel free to bid on both jobs, or mention your web experience here and I can discuss combining the engagements.