Comprehensive VAPT & AppSec Audit

I need a full grey-box security assessment covering both the Android and Web versions of my application, all of which run on AWS infrastructure. You will have complete source-code access, so please combine dynamic penetration testing with static code review to uncover anything a traditional black-box approach might miss.

Key risk areas to probe:
• Data breaches
• Authentication flaws
• Malware threats
• Overall AppSec posture

Your work should span OWASP Top 10 techniques, include cloud-specific checks for our AWS setup, and leverage industry-standard tooling such as Burp Suite, OWASP ZAP, MobSF, Metasploit, and relevant AWS security services.

Deliverables I expect:
1. A brief test plan outlining scope, tooling, and timelines before you start.
2. A detailed vulnerability report that assigns severity (CVSS), shows clear reproduction steps with screenshots or PoCs, and offers actionable remediation advice.
3. A concise executive summary suitable for non-technical stakeholders.
4. One free round of re-testing after fixes, culminating in a final security attestation letter.

Please outline your approach, estimated duration, and any prior experience with similar Android-plus-Web engagements on AWS.

Cost is fixed from Bank Side between 15 to 20k