Do we keep the test suite?

Yes. It lives in your repository, uses your CI and is documented at handover. There is nothing proprietary to keep paying for.

How do you measure coverage?

By user journey rather than by code line. Line coverage can be high while the checkout still breaks. We report which critical paths are automated, which are manual and which are untested.

Is your security testing a penetration test?

No. We test the OWASP Top 10 application risks and report severity-rated findings. A formal penetration test with a certificate for compliance purposes needs an accredited provider, and we will say so rather than imply otherwise.

QA and Testing

Security testing

The OWASP basics, tested properly.

Get a Rough Estimate Ask a question

QA and Testing from · United States

$70

QA engineer hourly

See all packages and ranges

Authentication, authorisation, injection, access control and dependency scanning, reported with severity and a remediation path. This is application security testing, not a formal penetration test certification.

What you get

OWASP Top 10 review
Access control testing
Dependency scanning
Severity-rated findings
Retest after fixes

How it fits the rest

Security testing is one part of quality assurance and testing. Most clients combine two or three of these, and the packages on the main service page price them together.

Back to QA and Testing

Questions

About qa and testing

Playwright for most new work because of its speed and reliability. We also work in Cypress and Selenium, and will stay in whatever your team already maintains rather than forcing a migration.