App audit · €490 excl. VAT
The app audit. Can user A see user B’s data?
The app audit tests your application the way a logged-in attacker sees it. With two test accounts we check automatically whether users can see other people’s data, whether sessions are secure and whether inputs and APIs can be attacked. Preferably on your staging environment and only with your approval by email.
- Price
- €490 excl. VAT
- Delivery
- 1 working day
- Access
- Address + 2 test accounts
- Result
- Report with action plan
All prices net, plus VAT. Businesses only. Our terms and conditions apply.
What we check
- Everything in the security check
- Login, sessions and rate limits
- Can user A see user B’s data?
- Injection and unprotected APIs
- Report for management and IT
How it works
Methodology- 01
Approval and accounts
You approve the tests by email and provide two test accounts without MFA.
- 02
Automated tests
Scanners and AI agents check login, rights, injection and APIs along the OWASP Top 10.
- 03
Report
Findings with risk, location and recommendation, prioritised for your team.
What you get
View sample report (PDF)- Report for management and IT
- Findings rated with CVSS 3.1
- Prioritised action plan
- Proof for customers and partners
Compared
| Security checkfree | App audit€490 | Code audit€890 | Full audit€1,690 | EnterpriseOn request | |
|---|---|---|---|---|---|
| What is tested | |||||
| TLS, security headers, cookies | included | included | partly | included | included |
| Login, sessions, rate limits | not included | included | included | included | included |
| Access rights: can user A see user B’s data? | not included | included | partly | included | included |
| Injection (SQL, XSS, SSRF) | not included | partly | included | included | included |
| Secrets and keys | partly | partly | included | included | included |
| Supply chain, Docker, CI/CD | not included | not included | included | included | included |
| What you get | |||||
| Grade and number of findings | included | included | included | included | included |
| Report with a prioritised action plan | not included | included | included | included | included |
| CVSS 3.1 ratings | not included | included | included | included | included |
| Debrief and re-check | not included | not included | not included | included | included |
| Framework | |||||
| Access | URL and email address | Address + 2 test accounts | Read access to the code | URL, test accounts and code | individual |
| Delivery | usually within 2 hours on working days | 1 working day | 2 working days | 4 working days | individual |
Frequently asked questions
Is the app audit a penetration test?
No. It is an automated security test with login. It covers the most common vulnerabilities but does not replace a manual penetration test.
Do you need a staging environment?
Recommended. We test gently, but active tests do not belong on a production system unasked.
What about SSO or MFA?
The test accounts need a login without MFA and captcha, otherwise the tests cannot sign in.