Manual penetration test needed for educational technology application.

Manual Penetration Test for EdTech SaaS Web App (Required for University Vendor Approval) Cybersecurity & Compliance / Penetration Testing One-time project Estimated Budget:** Fixed price - $3,000-$5,000 (open to discussing scope adjustments to fit budget) We're a small software company (Drawbridge Inc.) that builds Eli Review, a peer-review writing platform used by students and instructors in higher education. We need a **manual penetration test** of our web application and API, primarily to satisfy a university customer's third-party vendor security review. We are **not** looking for an automated vulnerability scan with a report attached — we need a tester who manually assesses business logic, access control between user roles, and authentication/session handling, and can produce a report suitable for submission to a university information security office. What We Need Tested - Web application (single production or staging environment — we'll provide the URL and test accounts) - REST API supporting the application - Role-based access control: our app has student, instructor, and admin roles — we specifically want testing of whether one role can improperly access another's data (e.g., a student viewing another student's peer review submissions, or cross-course data leakage) - Authentication and session management (login flow, password reset, session handling) - LTI/LMS integration points (we'll clarify exact scope with finalists) What We'll Provide - Access to a staging environment (preferred) with test accounts across all user roles - Basic architecture documentation - A point of contact for questions during testing Deliverables - Full technical findings report (scope, methodology, findings with severity ratings, proof-of-concept evidence, remediation recommendations) - **An executive summary of findings** suitable for sharing with a university vendor risk review team (this is a hard requirement - we need something we can submit externally, not just an internal-only report) - Availability for a brief call to walk through findings Ideal Candidate - Demonstrated experience with **manual** web application penetration testing (not just automated scanning) — please reference specific methodologies or tools you use for testing business logic and access control - Relevant certifications preferred (OSCP, CREST, GWAPT, or similar) - please list any you hold - Experience with SaaS/multi-tenant applications a plus - Experience producing reports for higher-education or compliance contexts (HECVAT, SOC 2 support, FERPA-relevant environments) is a strong plus given our use case, but not required - Comfortable working within a fixed timeline and fixed-scope budget Timeline Looking to start as soon as possible and have a completed report within 2 weeks of kickoff. To Apply, Please Include 1. A brief description of your manual testing methodology (what you do beyond automated scanning) 2. 1-2 examples of past web app/API pentest engagements (sanitized/redacted is fine) - ideally similar in scope to a single web app + API 3. Relevant certifications 4. A proposed fixed price and estimated turnaround time for the scope described above 5. Whether you're able to provide an executive summary format suitable for external/university submission