I break your app before their security team does.
A buyer’s security questionnaire is holding up your deal, and a big-firm pentest is priced for enterprises. I pentest your SaaS web app by hand at a flat price, write the report their reviewer will read, and answer the application-security questions from what I found.
5 business days · $1,500 flat · no high or critical finding, no fee
What I test
Meet me
One person. Your app. No juniors.
I’m Dawid. I do one thing: penetration tests of SaaS web apps, priced for small teams. I look hardest for the bugs that let one customer see another customer’s data. I scope it, test it, write it and walk your devs through it.
1 person.Placeholder: swap for your photo
Six bugs I keep finding in SaaS apps.
Composite examples. No client names, no real data. Open one to see how I got in.
Invoice IDs anyone can changeHigh
Change the number in the URL. The server returns another customer’s invoice.
Check the invoice belongs to the caller’s account before returning it.
Reset links that work twiceHigh
Use a reset link, then use it again. It still sets a new password.
Expire the token the moment it is used, and after 30 minutes regardless.
Logins that outlive a password changeMedium
Change the password in one browser. The session in another stays signed in.
Invalidate every other session when credentials change.
An avatar upload that runs codeCritical
Upload a script with an image extension. The server executes it.
Check file content, rename on upload, and serve from a domain that cannot execute.
A free plan that upgrades itselfMedium
Add a plan field to the signup request. The server believes it.
Set plan and role on the server, never from the request.
An endpoint the interface hidesHigh
Call the admin endpoint with a normal user’s token. It answers.
Enforce permissions in the API, not only in the screens.
Everything the buyer asks for, in one folder.
Stuck on a buyer’s security questionnaire? Here is the evidence you hand back.
A hands-on pentest
Login, access control, input handling, sessions and the API, tested by hand on a staging copy.
A report in plain English
Each finding has a severity, proof you can reproduce, and the change that closes it.
One page for the buyer
A non-technical summary written for the person on the other side of the deal.
The app-security answers
The technical questions in their questionnaire, answered from what I actually tested, with the report as evidence.
A debrief with your devs
Thirty minutes on what to fix first and why.
A free retest
Fix the critical items and I check them again at no charge for 30 days.
Five days from questionnaire to answers.
Scope call Monday. Report in your inbox by Friday.
Scope
We agree what’s in. You sign the authorization and a mutual NDA, and send a staging URL.
20 minutes
Test
I go through your app by hand, as a customer, as an attacker, and as a curious intern.
2 days
Write
The report, the executive page and the filled-in questionnaire.
2 days
Debrief
I walk your team through the findings and the order to fix them.
30 minutes
Retest
You fix the critical items. I check the fixes.
Free, 30 days
No high or critical finding, no invoice.
A real pentest, priced for a startup. Flat, and quoted before we start.
The pentest
Flat. Written scope. Written deadline.
- Hands-on pentest of your staging app
- Report and executive summary
- App-security questionnaire answers
- 30-minute debrief and a free retest
- Mutual NDA
Not a fit if you need a SOC 2 certification, a network pentest, or you have no users yet. I’ll say so on the call.
Guarantee
You read it before you pay.
You keep the report either way. If I find nothing high or critical, you owe nothing.
Scope
Safe by default.
Testing happens only with your written authorization.
access test account
paper signed authorization + NDA
Questions, answered.
The ones founders ask before they send the questionnaire.
Is this a real pentest?
Yes. It is a hands-on penetration test of your web app and API, scoped to a fixed price and five business days. It is not a network pentest or a months-long red team.
Are you certified?
No. Read the sample report and judge the work. One person scopes, tests, writes and debriefs your review.
Is this legal? What do you need from me?
A signed authorization and a defined scope, every time. I only test systems you own or are permitted to test.
Do I have to give you production access?
No. A staging copy and a test account are enough. If you don’t have staging, we’ll work out a safe way.
Do you fix the issues too?
No. You get a prioritized list your developers ship, which keeps the cost down and the knowledge on your team. I retest the critical ones free.
Does this replace SOC 2?
No. SOC 2 is an audit by an accredited firm. This is hands-on testing, and it gives you real evidence while the audit is in motion.
How soon can you start?
Usually the same week. The report lands within five business days of getting access.
Send me the questionnaire, audit request or deal that’s blocking you.
Tell me which one in a sentence. I reply with a fixed quote and a start date, and we book the free 20-minute scope call.
$1,500 flat. No high or critical finding, no fee.