Handoff Security / service-notes

Service scope & important notes

Payment terms: full payment is required before testing begins. The quotation and written agreement specify the scope, fees and delivery arrangements.

Focused Web & API Security Testing

Check selected website features

Manual testing of agreed login, permissions and data-access features. Receive documented findings and guidance for your developer.

From HK$7,800

Scope

1 app · Up to 2 workflows / 2 roles / 6 API endpoints

Each API endpoint counts as a combination of HTTP method and normalised path.

For example, GET /orders and POST /orders are different endpoints. Complex cases require scope review.

Test environments, test accounts and test data rather than real customer data are preferred.

All listed limits apply together. Agree simple workflows, endpoints, access boundaries and test accounts before quoting; separate same-role accounts are needed where ownership checks require them.

Complex payment flows, multi-tenant permissions, uploads and integrations require separate scoping and a higher quote when they exceed the starting scope.

Included work

Manual testing: within the agreed scope, checks cover sign-in identity verification, user permissions, data access and applicable input handling.

The test does not promise every website security check listed by OWASP.

Deliverables

Test records, reproduction steps and evidence, verified impact, risk ratings and rationale, remediation advice and limitations.

Briefing & retesting

Includes one online walkthrough up to 30 minutes, and one retest of original findings within 30 days after the report, up to 2 hour(s). Extra work agreed separately.

Exclusions

Code changes.
Full source-code review.
Denial-of-service testing (DoS), which attempts to make a service unavailable.
Social engineering, which deceives people into providing information or access.
Internal lateral movement, which involves moving into other internal systems after gaining access.
Compliance certification.

External Vulnerability Assessment

Check an external website entry point

Automated scanning checks one agreed internet-facing host or website entry point for common issues; we manually verify important results. This does not cover all features behind a login.

From HK$4,800

Scope

1 external target

One external host or website entry point, agreed and authorised in writing beforehand.

List the target IP address or fully qualified domain name (FQDN), services and exclusions.

The starting price depends on the agreed exposed services and verification effort; a host with numerous services requires separate scoping.

Included work

Automated vulnerability scanning with manual verification of important results.

Unverified items are labelled; scanner output is not automatically treated as confirmed vulnerabilities.

Deliverables

Scope, findings, verification status, risks, limitations and remediation advice.

Briefing & retesting

Includes one online walkthrough up to 20 minutes, and one retest of original findings within 30 days after the report, up to 1 hour(s). Extra work agreed separately.

Exclusions

Excludes comprehensive testing after login, business-workflow logic testing, internal-network testing and a full web application penetration test.
Third-party services and other assets on a content delivery network (CDN) or shared hosting are not automatically included.

Finding Verification & Retesting

Check a reported problem or fix

Check one issue using an existing report or details showing how it occurs. Failure to reproduce the problem does not prove it is fixed.

From HK$1,200

Scope

1 specified issue · Up to 1 hour

Client supplies an existing report or usable reproduction details, lawful authorisation and ready test access. The listed hour limit covers hands-on verification.

Setup investigation, additional issues or work beyond the agreed limit require a new quote before continuing.

Deliverables

Short written reproduction / verification records and limitations.

Failure to reproduce does not prove a fix.

Exclusions

Excludes a new comprehensive assessment or reissuing the original provider’s compliance conclusion.
Retests already included in External Vulnerability Assessment or Focused Web & API Security Testing are not charged again under this service.

Starting prices apply only to the limited scopes listed. A fixed quote follows confirmation of technology, complexity, scope and timing. Fees cover agreed work and deliverables, not the number of findings. No guarantee of finding vulnerabilities or complete security. All testing requires prior written authorisation.

FAQ

How do I know whether testing is useful?

Describe your website and what concerns you. A simple information website may need a narrower assessment or may not fit these services; customer accounts and online transactions involve different checks. Suitability and scope are discussed before a quote.

What if I do not know how my website was built?

That is fine. Explain what visitors can do and whether someone maintains it. Technical details and required access can be established later with the appropriate person; do not send passwords in an initial enquiry.

How do scanning and manual testing differ?

Scanning uses tools to check for common security issues and flag results for investigation. Important results still need a person to verify them. In manual testing, a tester examines how the application actually works—for example, whether a signed-in user can see another user’s data or perform actions beyond their permissions.

Will you fix the website?

We test and explain findings and remediation advice. Your developer implements changes; code changes and ongoing maintenance are excluded. If you have no developer, discuss how findings could be followed up before commissioning testing.

How is pricing agreed?

Describe what your website or application does, its approximate size and what you want checked. We review the technology, scope, complexity and timing before providing a fixed quote. Starting prices apply only to the scope listed for each service. Start and delivery dates are agreed based on the scope and schedule. Before testing, the quote must be confirmed, written authorisation obtained and any required test accounts or access arranged.

When can testing start?

Start and delivery dates are agreed based on the scope and schedule. Before testing, the quote must be confirmed, written authorisation obtained and any required test accounts or access arranged.

Can you test a website that is already in use?

A separate test environment is preferred. Testing a live website requires prior agreement on authorisation, the areas to test and the arrangements. Denial-of-service testing—attempts to make a service unavailable through large volumes of requests or other means—is excluded.

Are vulnerabilities guaranteed?

No. Fees cover the agreed testing work and deliverables, not the number of vulnerabilities found. Completing a test does not mean the application is completely secure.

What does retesting include?

Retesting checks the issues in the original report after remediation; it is not another full assessment. External Vulnerability Assessment and Focused Web & API Security Testing each include one retest, subject to their listed period and hour limits. Additional work is agreed separately.

Can you test any website or online shop I use?

No. Agreed targets require prior written authorisation from someone entitled to grant it. Owning an account or shop does not automatically permit testing the provider’s platform, shared hosting or other third-party systems. Requirements must be checked before work is agreed.

What information will the report include?

The report sets out the agreed scope, results, risks, remediation advice and testing limitations to help you and your developer plan follow-up work. Confirmed findings are distinguished from unverified results; verification records and reproduction steps are provided within the deliverables of the selected service.