Skip to content
Ubaid_ur_Rehman
Email
Back to portfolio

Services & pricing

Published price list

Every price below is published in advance and covers a fixed scope: what is tested, what is delivered, how long it takes, and what a re-test costs. The scope is agreed in writing before the work starts, and the price does not move.

The work is for teams that need a written answer they can put in front of an auditor, a customer or their own engineers, and that need it from someone who does not also bill for the fixes.

All prices are in USD.

Start a conversationRead the methodology
$300
entry price, any engagement
5
engagement types, three tiers each
25%
founding-client rate, Standard tier
30 days
free retest of critical and high findings

How an engagement runs

  1. Written authorisation and scope

    01

    A signed scope naming the target, the roles, the endpoints or the repository, and the dates. Nothing is tested before that document exists.

  2. The work

    02

    The engagement is carried out against that scope, and the evidence behind each finding is collected as it is found.

  3. A written report and a walkthrough

    03

    A written report carrying the evidence for every finding, and a walkthrough of what was found, what it means and what to do about it.

  4. A free retest

    04

    One retest of the Critical and High findings within 30 days of the report, at no charge.

Security engagementsFixed scope

Five engagement types

Each one is quoted against a single unit of work, so the tier you pick is a statement about scope rather than about budget. The three tiers of every engagement are listed below, with the effort each one takes.

API route inventory & OWASP API review

Every route the backend actually registers, diffed against the specification, ranked against the OWASP API Top 10.

What counts as a unit

One service. A route is a unit, not a line of code.

Tiers, scope, price and effort for API route inventory & OWASP API review
TierScopePriceEffort
InventoryUp to 25 routes, one service, no specification supplied. Route inventory, authentication context per route, OWASP API Top 10 mapping, one-page findings list.$3001 day
ReviewStandardUp to 75 routes across services, specification-versus-code diff, findings ranked by severity with file references, 30-minute walkthrough, one re-review.$7002 days
AuditMulti-service or monorepo, specification diff, CI integration, per-finding remediation snippets, two re-reviews, a redacted summary you can forward to a customer.$1,4003-4 days

Recommended — the Review tier is the tier the founding rate applies to. It is the tier that produces a ranked, file-referenced findings list with a walkthrough and a re-review, rather than an inventory.

Evidence

  • shadowaudit — the tool that does this, on npm, with 520 tests
  • 269 routes found in Ghost CMS, 0 false positives after the auth-detection fix
  • SARIF 2.1.0 output that lands in GitHub code scanning

Android app security review

Permissions, exported components, storage, network security and the API surface behind an Android app — with the evidence for each finding.

What counts as a unit

One app. One version, or a stated range of versions.

Tiers, scope, price and effort for Android app security review
TierScopePriceEffort
StaticAPK or AAB only. Manifest, permissions, exported components, hardcoded secrets, storage and network configuration, findings list and a short written report.$4001-2 days
Full reviewStandardStatic analysis plus dynamic testing on a rooted device: SSL pinning, local storage, IPC and WebView handling, API traffic review, a written report with proof of concept, 30-minute walkthrough, one retest.$9003-4 days
Release auditEverything in the full review, plus a spot-check of the backend API behind the app, MASVS mapping, two retests, and a sanitised summary for an app store or customer review.$1,6005-6 days

Recommended — the Full review tier is the tier the founding rate applies to. Static analysis alone cannot show what the app does on a device; this tier adds the dynamic pass, which is where the storage and WebView findings surface.

Evidence

  • 12 F-Droid submissions reviewed, with the reports published as merge requests
  • Static and dynamic analysis on a real device — jadx, apktool, Frida, Objection
  • Findings reported against OWASP Mobile and MASVS, with reproduction steps

Web application penetration test

A grey-box test of a running web application, with a written report, a walkthrough, and a retest once the fixes land.

What counts as a unit

One application, a stated number of roles, and a stated number of API endpoints.

Tiers, scope, price and effort for Web application penetration test
TierScopePriceEffort
PilotOne role, no source access, one application, no API scope. OWASP Top 10 only. A written report and one walkthrough. This tier exists to scope a larger engagement, and it is limited to three engagements.$1,2003-4 days
StandardStandardUp to three roles, OWASP Top 10 plus OWASP API Top 10 on the application's own API, evidence for every finding, an executive summary, a debrief call, and one retest.$2,8005-7 days
FullSource access, multi-role testing with two accounts per role, two test tenants, rate-limit and business-logic testing, two retests, and a signed summary usable with enterprise customers.$5,00010 days

Recommended — the Standard tier is the tier the founding rate applies to. It is the smallest tier with evidence for every finding, an executive summary and a retest, and it is priced below the published floor for a human-led test.

Evidence

  • 9 vulnerabilities found on EC-Council's own platform in a single day, 3 of them critical
  • 20 disclosed vulnerabilities across three engagements
  • EC-Council Hall of Fame 2026

Auth, RLS and secrets code review

A line-by-line review of the parts of a repository that decide who can do what — and the corrected SQL for every finding.

What counts as a unit

One repository. A monorepo is quoted per package.

Tiers, scope, price and effort for Auth, RLS and secrets code review
TierScopePriceEffort
Spot checkOne repository, one concern: hardcoded secrets, or authentication and session handling. A ten-point check, the fixes written out, and a short report.$4001-2 days
Access control reviewStandardOne repository: RLS policy semantics, USING and WITH CHECK, SECURITY DEFINER views, storage bucket policies, service-role exposure, route ownership, webhook verification, dependency posture. Corrected SQL per finding, one re-review.$9003-4 days
Architecture reviewMultiple repositories, a two-tenant isolation test, an authorization design review, a threat model, remediation pull requests, and a CI gate for secrets and SARIF findings.$1,8006-7 days

Recommended — the Access control review tier is the tier the founding rate applies to. It is the tier that returns corrected SQL for every finding, which is the part that is slow to redo in-house.

Evidence

  • KarobarX and Pak Books: row-level security on every user-facing table
  • Token-based admin auth, HMAC-signed sessions, audit logs, Turnstile, rate limiting
  • Every finding comes with corrected SQL, not a description of a problem

Dependency & CI security review

What your build actually pulls in, what your CI can be made to do, and what to change first.

What counts as a unit

One repository for the entry tier, one to three for the review.

Tiers, scope, price and effort for Dependency & CI security review
TierScopePriceEffort
ManifestOne repository, manifest only: end-of-life runtimes, abandoned packages, known CVEs, licence risk, an exact upgrade for each line, and a ranked fix list.$3501-2 days
ReviewStandardOne to three repositories: transitive dependencies, lockfile integrity, unpinned actions, dependency-confusion and typosquat exposure, CI secret handling, branch protection, and a prioritised upgrade and CI policy.$1,1003-4 days
Pipeline auditThe CI pipeline in depth: runner isolation, build-script and self-hosted runner exposure, artifact integrity, a CycloneDX SBOM, and a signed policy set to enforce it.$2,8007-8 days

Recommended — the Review tier is the tier the founding rate applies to. A manifest read only finds direct dependencies; this tier covers transitive dependencies, unpinned actions and CI secret handling.

Evidence

  • Upstream merges into Inkscape, Wireshark and gitlab-shell
  • GitHub Actions and GitLab CI pipelines written and reviewed
  • shadowaudit ships a GitHub Action and a documentation site
Founding clientsExpires 31 December 2026

The founding-client rate

A discount, not a lower base rate. The standard price stays on this page, and it appears above the discount on the invoice as its own line.

The discount, by engagement

Founding client rate

25% off the Standard tier, for the first three engagements of each type, booked before 31 December 2026. The standard price is what you pay from the fourth engagement onwards.

The rate applies to engagements booked before 31 December 2026. After that date, and after the third engagement of each type, the standard price applies.

Standard tier price, founding-client rate and the difference for each engagement
EngagementStandard tierStandard priceFounding rateDifference
API route inventory & OWASP API reviewReview$700$525-$175
Android app security reviewFull review$900$675-$225
Web application penetration testStandard$2,800$2,100-$700
Auth, RLS and secrets code reviewAccess control review$900$675-$225
Dependency & CI security reviewReview$1,100$825-$275
Terms

What every engagement carries

These terms apply to every price on this page, including the founding rate. They are the part of the price that is not a number.

Minimum engagement
One day, $400. Below that, scoping and reporting cost more than the testing.
Retest
One free retest of Critical and High findings within 30 days of the report. Further rounds are half the original fee, or a new fixed quote.
Remediation
Fixing what I found is a separate quote at $75/hr — testing my own work is not independent, and a firm that does both is not reviewing itself.
Advisory
$75/hr, two-hour minimum. For architecture questions, review calls and hiring input that have no deliverable.
Payment
50% to start and 50% on delivery of the draft report. Above $2,500 it is 25% to reserve, 50% on draft, 25% on the final report after the retest.
Authorisation
Written authorisation and a signed scope, before anything starts. PECA 2016 has no safe-harbour provision for security research in Pakistan, so the signed scope is the licence, not a formality.
Free work
Open-source projects and students are reviewed at no charge. I have already done twelve F-Droid audits on that basis.
Development workQuoted against a written spec

Builds, hourly work and advisory

Development work is quoted against a written spec rather than an hour count that drifts. The spec fixes the deliverables, and the price is fixed against them.

Hourly
$30–$45 per hour
Build band
$1,500–$4,500 fixed price
Advisory
$75 per hour, two-hour minimum

The build band covers the stack this site and these products are built in: a React front end on Supabase, with authentication and row-level security, deployed on Cloudflare, with the tests and the CI that keep it working. Anything outside that shape is quoted the same way — a spec, a price, and a date.

fixed-price buildquoted against a spec

stack React · Supabase (auth + RLS) · Cloudflare

price $1,500 – $4,500 fixed

basis written spec, not an hourly estimate

rate $30 – $45 / hr outside a fixed scope

The band moves with the number of screens, tables and integrations in the spec.
Before you write

What a quote needs

Five things, and the scope can be quoted from the first message. Whatever is missing from it is what the first reply is about.

Start a conversation

  1. Target

    The application, service, repository or pipeline, named specifically. A URL, a repository and a branch are targets; a product name is not.

  2. Roles

    How many roles to test and whether each needs its own account. Roles move the effort more than anything else on this list.

  3. Endpoints or repository

    The endpoint list or the API specification, or the repository and the branch to be reviewed.

  4. Deadline

    The date the report is needed by, and whether anything goes live before it.

  5. Source access

    Whether source, staging and infrastructure access can be given. It changes the tier as much as the roles do.

Send the five answers to arifubaid0345@gmail.com, or read how the work is done in the methodology notes.