Overview
Indian web platforms often stitch payment gateway callbacks, OTP-based login and KYC journeys onto an older back office. Every one of those joins is a place where the server may trust something it should check. Our web application VAPT works through them one role at a time, and the report is written so your developers can fix quickly and your auditor, whether for RBI, SEBI, ISO 27001 or a customer questionnaire, can see the scope, dates and method at a glance.
A web application is where most organisations expose their data to the internet, so it is where attackers look first. We approach each engagement as a reviewer who has an account and intends to abuse it, probing how the application handles untrusted input, how it decides who may see what, and where its logic can be pushed past the paths the developers intended.
Our testers work through the OWASP Web Security Testing Guide by hand, using automated tooling only to map the surface and confirm coverage. The hours go into the problems tools cannot judge: whether one tenant can read another's records, whether a low-privileged user can reach an admin function, and whether a multi-step workflow can be completed out of order to skip a payment or an approval.
You receive findings that an engineer can reproduce from the report and an auditor will accept. Each issue carries a CVSS v4.0 score, the exact request that triggered it, the business impact in plain language, and a fix that fits your stack. Critical issues are raised the moment we confirm them, so you are never waiting on the final document to start remediation.
How we work with Indian clients
- Fixed-price proposals in INR, with 18% GST shown separately on every invoice
- Remote-first delivery from Ahmedabad in IST working hours; on-site work can be discussed at scoping
- Signed authorisation, an NDA on request and agreed testing windows before any activity begins
- Reports and closure evidence shaped for RBI, SEBI CSCRF, IRDAI, DPDP, ISO 27001 and PCI DSS reviews
What's included
Our approach
- Scope & accountsWe agree targets and rules of engagement, then collect test accounts for each role.
- MappingWe enumerate pages, parameters and APIs behind the app to build a complete test surface.
- Manual testingTesters work the WSTG checklist by hand, chaining issues into realistic attack paths.
- VerificationEvery finding is reproduced and evidenced before it reaches your report.
- Report & debriefWe deliver the report and walk your team through risks, fixes and priorities on a call.
What you receive
- Executive summary written for a non-technical reader
- Risk-rated findings with CVSS v4.0 scores and reproduction steps
- Developer-ready remediation guidance per issue
- Illustrative sample evidence for each finding
- Free retest of fixed issues and an attestation letter
Standards & frameworks
- OWASP WSTG
- OWASP ASVS
- OWASP Top 10
- PTES
- NIST SP 800-115
- CVSS v4.0
- CWE
- DPDP Act 2023
- RBI IT Governance Direction 2023
Frequently asked questions
Do you need accounts and a test environment?
Authenticated testing finds far more than an anonymous scan, so we ask for one account per role, ideally in a staging environment that mirrors production. If only production is available we agree safe limits in writing before any testing begins.
Will testing take the application down?
Our aim is to find flaws, not to disrupt you. We avoid denial-of-service techniques, throttle noisy checks and schedule any higher-risk tests with your team. A named contact can reach the tester throughout so anything unexpected is paused at once.
How do you handle the data in our application?
We treat your data as confidential, work under an NDA on request, and avoid exfiltrating real records. Where we must prove access we capture the minimum evidence needed and redact it, then destroy test artefacts after the engagement closes.
Do you quote in rupees, and is GST extra?
Yes to both. Proposals are fixed-price in INR, and 18% GST is added on the invoice. The figure covers testing, the report, a debrief call and a retest of the findings you fix.
Can this report go to our RBI or SEBI auditor?
Reports show scope, dates, method, CVSS-rated findings and closure status, which is what auditors normally look for. If a regulator or contract insists on a CERT-In empanelled auditor, note that we do not claim empanelment; raise it when we scope the work and you will get a clear yes or no on whether we can meet it.