Low-budget grey-box pentest for a small Amazon SP-API integration (verifiable CEH/OSCP/CREST required)

I'm a solo developer with a small, self-built integration for the Amazon Selling Partner API. Amazon requires a penetration test by a certified tester (Data Protection Policy). The project is small, source code and documentation are provided, and my own scans show no open Critical or High findings. Budget is very limited.

REQUIREMENTS (please read first)
- A pentest certification that I can verify online: CEH (incl. CEH Practical/Master), OSCP/OSCP+, OSWE, CREST CRT/CCT, PNPT, eCPPT, eWPT/eWPTX, GPEN or GWAPT.
- Send the verification link with your offer (EC-Council, credentials.offsec.com, CREST, Credly or similar). Offers without a link will not be considered.
- You perform the test yourself. Your full name and certification appear in the report.
- Manual testing, not just a scanner run.
- Short NDA and written test authorization before the start.

WHAT TO TEST (grey-box, small scope)
1. PHP OAuth gateway on shared hosting (public, about 10 endpoints):
Login with Amazon flow, callback and state handling, token handling, signed requests, sessions, input validation, HTTP/TLS configuration. The hosting provider's infrastructure is out of scope.
2. Local REST API (Windows, Python; internal only, one user role):
authentication, access control, input validation, OWASP API Security Top 10, plus a basic host/network check of the API machine (open ports, services, TLS). You test an isolated test instance with synthetic data only, no real customer data.
3. Desktop client (Python/Qt):
storage of credentials and tokens, communication with the API, exposure of sensitive data.

PROVIDED AFTER SELECTION
Source code, OpenAPI documentation, exact endpoint list, test accounts, access to the test instance, and the results of my own SAST/DAST/dependency scans.
Estimated effort: about 2 testing days.

REPORT
Test dates, scope, methodology (OWASP WSTG / OWASP API Security Top 10), executive summary, findings rated with CVSS v3.1, evidence, remediation recommendations. After my fixes: one retest with an updated report.

TIMELINE AND BUDGET
- Report by 25 November 2026 at the latest; retest within one week after my fixes.
- Fixed price of max. 200 EUR, including one retest.

TO APPLY, PLEASE SEND
1. Verification link of your certification
2. Fixed price including one retest
3. Earliest start and delivery date
4. An anonymized sample report