I will do a web app penetration test with a soc 2 ready report

Yes, I take precautions to avoid disruption. I recommend testing on a staging environment first. If production testing is required, we schedule it during low-traffic hours and use non-destructive techniques throughout.

I test for all OWASP Top 10 vulnerabilities: SQL injection, XSS, CSRF, broken authentication, IDOR, security misconfigurations, insecure APIs, and more. Scope depends on your application type and selected package.

I need the application URL, test credentials for each user role, and any areas that are out of scope. A brief description of the tech stack helps me tailor the testing. No source code is required.

You receive a detailed PDF report with an executive summary, all vulnerability findings with CVSS scores, screenshots, proof-of-concept steps, and prioritized remediation recommendations your dev team can act on immediately.