Harbor Artificial Contact
Menu Close

Code & AppSec · S-CODE-7

Web App Security Review (ASVS-mapped)

Verify your web app against OWASP ASVS 5.0.

Scope. Not a penetration test, audit, or certification; no guarantee of breach prevention; written authorization required before any active testing.

Compare 3 tiers Book a call

Pricing

Compare tiers

Pay the deposit to start. Pay the final balance before handoff.

Starter

$1,900

Hours. 15 hours

Scope. ASVS L1 selected chapters, ≤25k LOC

Deliverables

  • ASVS checklist (pass/fail/NA)
  • findings

Turnaround. 6 business days

Pay deposit ($950) (opens Stripe in a new tab) Pay final balance ($950) (opens Stripe in a new tab)

Balance is due before handoff.

Terms cover this engagement. A statement of work controls the scope.

Scope. Not a penetration test, audit, or certification; no guarantee of breach prevention; written authorization required before any active testing.

Advanced

$5,300

Hours. 48 hours

Scope. ASVS L2, ≤150k LOC, authorized staging ZAP baseline

Deliverables

  • Standard items
  • remediation roadmap

Turnaround. 14 business days

Pay deposit ($2,650) (opens Stripe in a new tab) Pay final balance ($2,650) (opens Stripe in a new tab)

Balance is due before handoff.

Terms cover this engagement. A statement of work controls the scope.

Scope. Not a penetration test, audit, or certification; no guarantee of breach prevention; written authorization required before any active testing.

Retest included: Starter, one retest of Critical and High findings within 30 days; Standard, one retest of all findings within 45 days; Advanced, two retests within 60 days. Another round is the Extra Retest add-on.

Scope

Deliverables, limits, and standards

Standards mapping

OWASP ASVS 5.0.0 (Level 1 / Level 2); OWASP Top 10:2025; CWE; NIST CSF 2.0 PR.PS.

Exclusions

  • ASVS Level 3
  • certification or "ASVS compliant" letters (Harbor issues none)
  • production DAST

Acceptance

Checklist states each in-scope ASVS requirement ID with verdict and evidence pointer.

Scope. Not a penetration test, audit, or certification; no guarantee of breach prevention; written authorization required before any active testing.

Book a call All security services

More in Code & AppSec

Not sure this tier is the one?

Email [email protected] with the system you want reviewed. We will point at a tier in this catalog, or tell you if the work is outside it.

Book a call All security services