Website & API security · Hong Kong
We provide website and API security testing for Hong Kong businesses. Agree what needs checking, receive clear findings, and give your developer practical guidance for follow-up.
Find out whether a limited check of your public website entry point is appropriate.
Discuss selected logins, bookings, private records or API features.
Verify one reported problem or check a developer’s fix.
Suitability depends on your website, hosting and authorisation. Third-party platforms are not automatically included.
You do not need to choose a technical package. Describe your website first. We review suitability and agree the scope before providing a fixed quote.
Focused Web & API Security Testing
Manual testing of agreed login, permissions and data-access features. Receive documented findings and guidance for your developer.
From HK$7,800
1 app · Up to 2 workflows / 2 roles / 6 API endpoints
Excludes code changes, denial-of-service testing (DoS) and compliance certification.
External Vulnerability Assessment
Automated scanning checks one agreed internet-facing host or website entry point for common issues; we manually verify important results. This does not cover all features behind a login.
From HK$4,800
1 authorised external entry point
Excludes comprehensive authenticated and business-logic testing.
Finding Verification & Retesting
Check one issue using an existing report or details showing how it occurs. Failure to reproduce the problem does not prove it is fixed.
From HK$1,200
1 specified issue · Up to 1 hour
Excludes a new comprehensive assessment.
Fees cover agreed work and deliverables, not the number of findings. No guarantee of finding vulnerabilities or complete security. All testing requires prior written authorisation.
Manual testing of agreed login, permissions and data-access features. Receive documented findings and guidance for your developer.
Full scope & terms ↗Automated scanning checks one agreed internet-facing host or website entry point for common issues; we manually verify important results. This does not cover all features behind a login.
Full scope & terms ↗Check one issue using an existing report or details showing how it occurs. Failure to reproduce the problem does not prove it is fixed.
Full scope & terms ↗A finding should explain what happened, why it matters and where to start fixing it. This fictional example illustrates that structure.
We test and advise. Your developer implements the changes.
Deliverables shown relate to Focused Web & API Security Testing. Other services have their own scope.
EXAMPLE / ACCESS CONTROL
In this fictional scenario, changing a booking reference could expose a different customer’s booking details.
If present in a real application, this issue could expose information to a user who should not see it.
Check the signed-in user’s permission for each requested booking on the server. A hidden button alone does not restrict access.
Illustrative example using fictional data—not a client case or completed assessment.
Illustrative example using fictional data—not a client case or completed assessment.
Work directly with the tester responsible for your assessment, from agreeing the scope to reviewing the report. Clear findings and practical remediation advice help you and your developer plan the next steps.
Explain your website and concern.
Agree scope, fixed quote, dates and written authorisation.
Arrange test accounts and access; test data is preferred.
Receive the agreed report or records. Assessments include a time-limited walkthrough.
After developer changes, recheck original findings within the included limits.
Describe your website and what concerns you. A simple information website may need a narrower assessment or may not fit these services; customer accounts and online transactions involve different checks. Suitability and scope are discussed before a quote.
That is fine. Explain what visitors can do and whether someone maintains it. Technical details and required access can be established later with the appropriate person; do not send passwords in an initial enquiry.
We test and explain findings and remediation advice. Your developer implements changes; code changes and ongoing maintenance are excluded. If you have no developer, discuss how findings could be followed up before commissioning testing.
Describe what your website or application does, its approximate size and what you want checked. We review the technology, scope, complexity and timing before providing a fixed quote. Starting prices apply only to the scope listed for each service. Start and delivery dates are agreed based on the scope and schedule. Before testing, the quote must be confirmed, written authorisation obtained and any required test accounts or access arranged.
A separate test environment is preferred. Testing a live website requires prior agreement on authorisation, the areas to test and the arrangements. Denial-of-service testing—attempts to make a service unavailable through large volumes of requests or other means—is excluded.
No. Fees cover the agreed testing work and deliverables, not the number of vulnerabilities found. Completing a test does not mean the application is completely secure.
Describe your website and what concerns you. We review suitability, discuss the work and provide a fixed quote before testing. Dates and written authorisation are agreed separately.
Do not send passwords, tokens, customer personal data or sensitive screenshots in an initial enquiry.
