App audit · from €990 excl. VAT
The app audit. Can user A see user B’s data?
The app audit tests your application the way a logged-in attacker sees it. With two test accounts we check automatically whether users can see other people’s data, whether sessions are secure and whether inputs and APIs can be attacked. Preferably on your staging environment and only with your written approval.
- Price
- from €990 excl. VAT
- Delivery
- 3 working days
- Access
- Address + 2 test accounts
- Result
- Report with action plan
All prices net, plus VAT. For businesses only. Contract by individual offer.
What we check
- Everything in the security check
- Login, sessions and rate limits
- Can user A see user B’s data?
- Injection and unprotected APIs
- Report for management and IT
How it works
- 01
Approval and accounts
You approve the tests in writing and provide two test accounts without MFA.
- 02
Automated tests
Scanners and AI agents check login, rights, injection and APIs along the OWASP Top 10.
- 03
Report
Findings with risk, location and recommendation, prioritised for your team.
What you get
- Report for management and IT
- Findings rated with CVSS 3.1
- Prioritised action plan
- Proof for customers and partners
Compared
| Security checkfree | App auditfrom €990 | Code auditfrom €1,900 | Full auditfrom €5,900 | EnterpriseOn request | |
|---|---|---|---|---|---|
| What is tested | |||||
| TLS, security headers, cookies | |||||
| Exposed files, admin and debug pages | |||||
| Login, sessions, rate limits | |||||
| Access rights: can user A see user B’s data? | |||||
| Injection (SQL, XSS, SSRF) | |||||
| Secrets and keys | |||||
| Dependencies and known CVEs | |||||
| Supply chain, Docker, CI/CD | |||||
| Code quality and maintainability | |||||
| Architecture review and threat modelling | |||||
| Cloud infrastructure (AWS, Azure, Kubernetes) | |||||
| What you get | |||||
| Grade and number of findings | |||||
| Report with a prioritised action plan | |||||
| CVSS 3.1 ratings | |||||
| Code findings proven in the running app | |||||
| Expert review of every finding | |||||
| Debrief and re-check | |||||
| NIS2 and CRA readiness mapping | |||||
| Dedicated contact, recurring audits | |||||
| Framework | |||||
| Access | URL and email address | Address + 2 test accounts | Read access to the code | URL, test accounts and code | individual |
| Delivery | within 2 hours on working days | 3 working days | 5 working days | 10 working days | individual |
includedpartlynot included
Frequently asked questions
Is the app audit a penetration test?
No. It is an automated security test with login. It covers the most common vulnerabilities but does not replace a manual penetration test.
Do you need a staging environment?
Recommended. We test gently, but active tests do not belong on a production system unasked.
What about SSO or MFA?
The test accounts need a login without MFA and captcha, otherwise the tests cannot sign in.