Harbor Artificial Contact
Menu Close

Code & AppSec · S-CODE-4

IaC & Container Config Review

Catch cloud misconfigurations before they deploy.

Scope. Not a penetration test, audit, or certification; no guarantee of breach prevention; written authorization required before any active testing.

Compare 3 tiers Book a call

Pricing

Compare tiers

Pay the deposit to start. Pay the final balance before handoff.

Standard

$1,800

Hours. 14 hours

Scope. ≤200 IaC files, ≤2 environments

Deliverables

  • Starter items
  • policy-as-code baseline for CI

Turnaround. 6 business days

Pay deposit ($900) (opens Stripe in a new tab) Pay final balance ($900) (opens Stripe in a new tab)

Balance is due before handoff.

Terms cover this engagement. A statement of work controls the scope.

Scope. Not a penetration test, audit, or certification; no guarantee of breach prevention; written authorization required before any active testing.

Advanced

$3,200

Hours. 25 hours

Scope. ≤500 IaC files, ≤4 environments, modules

Deliverables

  • Standard items
  • module hardening plan
  • drift notes

Turnaround. 10 business days

Pay deposit ($1,600) (opens Stripe in a new tab) Pay final balance ($1,600) (opens Stripe in a new tab)

Balance is due before handoff.

Terms cover this engagement. A statement of work controls the scope.

Scope. Not a penetration test, audit, or certification; no guarantee of breach prevention; written authorization required before any active testing.

Retest included: Starter, one retest of Critical and High findings within 30 days; Standard, one retest of all findings within 45 days; Advanced, two retests within 60 days. Another round is the Extra Retest add-on.

Scope

Deliverables, limits, and standards

Standards mapping

CIS Benchmarks (AWS Foundations 7.1.0 etc. where mapped), OWASP Top 10:2025 A02; CWE; NIST CSF 2.0 PR.PS.

Exclusions

  • Live cloud API checks (that is S-CLOUD-1)
  • applying changes

Acceptance

Each finding cites file+resource and the scanner rule ID or manual-review ID; false positives listed separately with reason.

Scope. Not a penetration test, audit, or certification; no guarantee of breach prevention; written authorization required before any active testing.

Book a call All security services

More in Code & AppSec

Not sure this tier is the one?

Email [email protected] with the system you want reviewed. We will point at a tier in this catalog, or tell you if the work is outside it.

Book a call All security services