01
Web application security
Authentication, sessions, access control, input handling, sensitive workflows and security misconfiguration.
INDEPENDENT APPLICATION SECURITY
Know your exposure.
Fix what matters.
Practical web application and API security assessments for SaaS teams. Understand the risks that matter, validate what is real, and give engineers a clear path to remediation.
Independent practice · Shaswat Raj · India
ASSESSMENT WORKFLOW
Authentication reviewSessions · recovery · MFA flows
IN SCOPEAccess-control reviewRoles · tenant boundaries · object access
IN SCOPEAPI security reviewAuthorization · validation · exposure
IN SCOPEFindings & remediationEvidence · severity · practical fixes
REPORTILLUSTRATIVE WORKFLOW — NOT LIVE SCAN DATA
Authorization firstWritten scope before any testing
Evidence-ledPotential issues reviewed and validated
Engineer-friendlyPriorities and remediation guidance
WHAT I ASSESS
Security where your product meets the real world.
Application-focused reviews for the systems your customers and team rely on.
02
API security
Authorization boundaries, object-level access, authentication, rate-limit behavior and input validation.
03
Access-control review
Tenant separation, role permissions and attempts to reach resources outside an account's approved access.
04
Security readiness review
A focused look at key security controls, configuration choices and engineering practices.
05
Findings & remediation
Understand the issue, why it matters, how to reproduce it safely and what your team can change.
06
Retesting after fixes
Verify agreed remediation changes and document what has been resolved or remains open.
A CLEAR METHOD
Careful testing.
Useful answers.
The goal is not a long list of scanner output. It is a reliable assessment that helps your team make better security decisions.
01
Scope & authorization
Confirm ownership, approved domains, test accounts, environments, exclusions, timing and stop conditions.
02
Understand the application
Map approved routes, APIs, roles, data flows and important business workflows.
03
Test and validate
Use appropriate techniques, then manually review evidence and confirm reproducibility and impact.
04
Report & retest
Deliver prioritized findings, walk through the results and verify agreed fixes in a follow-up window.
WHAT YOU RECEIVE
A report your engineers can act on.
Clear enough for leadership. Detailed enough for the people fixing the issue.
Executive summary
Scope, key observations, risk themes and prioritized next steps.
- Assessment scope and limitations
- Validated findings summary
- Business context and priorities
Technical findings
Evidence-backed details to help engineers reproduce and address issues.
- Affected asset and severity rationale
- Safe reproduction steps and redacted evidence
- Impact and remediation guidance
Remediation walkthrough
A focused handover session to discuss important issues and implementation questions.
- Prioritized remediation discussion
- Engineering clarification
- Agreed next steps
Retest summary
A follow-up record of the agreed fixes that were checked.
- Resolved and unresolved items
- Verification evidence
- Remaining limitations
ENGAGEMENT OPTIONS
Start with the scope you need.
Illustrative starting ranges in INR. Final quotations depend on application size, roles, API surface, depth and agreed test conditions.
Readiness review
₹8k–15k
For a focused first look at a small product or release.
- Limited scope and agreed checks
- High-level observations
- Practical next-step guidance
INTRODUCTORY PILOT
Small SaaS assessment
₹15k–25k
For one small staging application with defined workflows.
- Agreed web app and selected API flows
- Manual verification of in-scope findings
- Written report and walkthrough
Web + API assessment
₹25k–45k+
For broader application and API workflows with more roles.
- Multiple user roles and flows
- Deeper access-control and API checks
- Detailed findings and retest option
Indicative independent-practice starting ranges, not a promise of a full penetration test at every price. A written scope and quote define exactly what is included.
START A CONVERSATION
Let's define the right assessment.
Share a little about your product, environment and timeline. I'll establish a safe, realistic scope before proposing any testing.
GOOD TO KNOW
Before we get started.
Do you test production systems?
Staging is preferred. Production testing is considered only when explicitly authorized, risk-assessed and covered by written rules of engagement.
Do you need credentials?
For authenticated testing, client-provided test accounts with agreed roles are usually needed. Real customer credentials should not be shared.
Will this make us compliant?
No. An application security assessment is not a certification or guarantee of SOC 2, ISO 27001, PCI DSS or any other compliance status.
How are findings confirmed?
Potential issues are reviewed for reproducibility, scope and impact before being described as validated findings. Limitations are documented.
Can you work with a development agency?
Referral or subcontracting arrangements can be discussed. The client, authorization, responsibilities and reporting path must be clear.
What happens before testing begins?
We agree target assets, authorization, scope, exclusions, schedule, emergency contact, data handling and stop conditions in writing.