Security Company to Audit and Penetration-Test Our Website and Web Application

We are engaging a security company to carry out an independent security audit of a public-facing marketing website and a customer web application (Laravel and MySQL, hosted on a Linux VPS, with a REST API used by a mobile app). The engagement must be performed by a company with recognised certifications and a proven record; individuals without a registered company will not be considered for this one.

Scope of work

• External and authenticated penetration testing of the website and web application against the OWASP Top 10 and OWASP ASVS, including the REST API
• Infrastructure review: server hardening, TLS configuration, exposed services, backup and logging practices
• Source-assisted review of authentication, authorisation, payment and file-upload flows
• Real-time monitoring recommendations: what to log, alert on and how to respond to incidents
• A written report with severity ratings (CVSS), proof-of-concept evidence, remediation guidance and an executive summary, followed by one re-test after fixes

Priority is given to companies that can show

• Certifications such as ISO 27001, CREST, OSCP, OSWE, CEH or CISSP held by the testers
• A proven track record: redacted sample reports, references and case studies from comparable engagements
• Experience with Laravel and PHP applications, and with Australian Privacy Act and Notifiable Data Breaches obligations
• Professional indemnity insurance and willingness to sign an NDA and rules-of-engagement agreement before testing begins

Timeline and budget: testing window of two to three weeks starting within the next month. Budget is AUD 2,000 to 4,000 depending on methodology and depth. Please include your company registration, certifications, methodology and a sample report in your proposal.