Ship Check
Focused scope
Price: From CHF 450
An agreed feature, user journey or API surface. For example, account recovery and its API endpoints.
Clear scope. Useful findings.
Security assessments for web apps, mobile apps and APIs. The price depends on how much of your product is included. Every assessment comes with the same reporting standard.
Services are offered for business and professional purposes. Prices are indicative starting points in CHF. Final scope and fees are agreed in writing before testing. No VAT is charged.
Security assessment
These examples show how scope affects price. We agree the features, endpoints and user roles to include before testing starts.
Focused Assessment
Broader scope
Price: From CHF 1’200
More of the application across connected features and user roles. For example, authentication, account permissions and associated API endpoints.
What we test
The exact checks depend on your app and the access agreed for the engagement. These are areas we can include, not a claim that every package covers every check.
- Accounts and authentication
- Sign-in, session handling, account recovery and privileged actions.
- Access control
- Whether one account can read another account’s data, act outside its role or cross a tenant boundary.
- APIs and application logic
- Exposed operations, input handling and whether important rules are enforced by the server rather than only the interface.
- Data handling
- Private records, files, exports and information exposed through the agreed application surface.
- Mobile applications
- App-to-API interactions, local storage and client-side assumptions, where the platform, build and testing access are agreed.
- Configuration and exposure
- Application configuration, unintentionally exposed information and secrets within the authorised scope.
How an engagement works
- Tell us what you have built. Share the product, its stage and what you are most concerned about. No credentials or sensitive data in the first message.
- Agree the scope and price. We define the assets, environments, accounts, permitted methods, schedule, deliverables and exclusions. You receive the terms and testing authorisation before anything starts.
- Test and validate. We assess the agreed surface and validate findings before reporting them. Urgent findings are raised through the agreed contact channel rather than held for the final report.
- Understand and fix. You receive the report and a walkthrough of the findings, priorities and remediation guidance. Code changes are not included unless separately agreed.
- Verify the changes. If a retest is included or booked, we check the named fixes and record what is resolved or still open.
Boundaries, without surprises
Testing starts only after written authorisation from someone entitled to grant it. A product URL or contact-form submission is not permission to test.
Denial-of-service testing, social engineering, live payment transactions and testing against real users are excluded by default. Third-party services are not automatically in scope because your app uses them.
A review reports what was tested and what was found under the agreed conditions. It is not a promise that every vulnerability has been found, a compliance certification or a guarantee against future incidents.
Not sure which review fits?
You do not need to choose a package before we talk. Tell us what you have built and what you want checked. We’ll recommend a scope and explain what it will cover.