Pentests and code review for web apps, APIs and mobile apps. Every finding comes with a concrete fix for your developers.
OSCP
Certified by OffSec
2 weeks
Usually until the start, once the scope is fixed
NDA
Confidentiality agreed in advance
from €1,950 excl. VAT
A manual test of your web application and API, with extra depth in Laravel and WordPress.
from €2,250 excl. VAT
A test of your iOS and Android app, including the API behind it. With extra knowledge of React Native.
More about the mobile pentestfrom €1,520 excl. VAT
Your source code read for vulnerabilities, with the fix for each finding. Add the GDPR code check, or order it on its own.
More about the code reviewYou have a website or web shop and want to know whether it is secure. You do not have to arrange anything technical: HackIndex sets up a safe copy, tests it and delivers a report your agency or developer can act on. If you have nobody and your site runs on WordPress, WooCommerce or Magento, HackIndex can fix it as a separate assignment.
Request a pentestHow much you share up front decides how thorough the test is. White box gets the most out of the same testing time.
You only share the address of your app. The test starts the way an outsider without an account would.
You share test accounts per role. The test works like a logged-in user who tries to get further than intended.
You also share the source code and documentation. The test is combined with a look at the code, so flaws surface faster and more completely.
Scanners find known flaws. Flaws in logic and permissions only turn up through manual testing. Every finding is verified and reproducible.
The starting prices are on the site. Once the scope is agreed you get a fixed price, with no extra charges afterwards.
Every finding includes a concrete fix, written from development experience with Laravel, WordPress and React Native.
HackIndex researches open-source packages, reports vulnerabilities to the maintainers and publishes CVEs.
Starting prices for a web and API pentest. Once the scope is agreed you get a fixed price.
€1,950
from, excl. VAT
€3,750
from, excl. VAT
€5,500
from, excl. VAT
Mobile pentest from €2,250
Security code review from €1,520
GDPR code check from €1,150
About black, grey and white boxHackIndex researches open-source packages for vulnerabilities and reports them to the maintainers.
| Status | Vulnerability | Package | Severity | CVE | Published |
|---|---|---|---|---|---|
| Published | Unsafe deserialization in statamic/importer CWE-502 | statamic/importer | High | Not yet | 12 Nov 2026 |
| Published | Access control not enforced in ai-openrouter-gateway CWE-862 | andrecorugda/ai-openrouter-gateway | High | Not yet | 7 Nov 2026 |
| Published | Stored XSS in parallax/filament-comments CWE-79 | parallax/filament-comments | Critical | CVE-2026-90943 | 14 Sep 2026 |
| Published | Hidden spyware and adware in the ModHeader browser extension Chrome Web Store en Edge Add-ons | ModHeader - Modify HTTP headers | High | Not yet | 12 Jul 2026 |
| In triage | Inefficient regular expression CWE-1333 | Hidden until publication | High | Not yet | Not yet |
| In triage | Missing authorization CWE-862 | Hidden until publication | Critical | Not yet | Not yet |
Package names and dates stay hidden until the maintainer has released a fix. That keeps users of those packages protected.
Everything can be done by email. The test starts by arrangement, usually within two weeks of the scope being fixed. No test environment? HackIndex sets one up for you.
By email or in a short call: what needs testing, why and when.
The test is scoped. A fixed price follows.
NDA, written permission and access to the test environment, or to your hosting when HackIndex sets it up.
Manual, with tools as an aid, in the evenings and at weekends. Critical findings are reported straight away.
Within 10 working days of the test, with the evidence and the fix for each finding, followed by a debrief.
Optional: once fixed, every finding is tested again. Included from Standard.
The report
A made-up example: the customer portal of a wholesaler, with 1 high, 2 medium and 3 low findings, and the retest included.
View the sample report An 18-page PDF, with made-up data.
A web and API pentest starts at €1,950 excl. VAT for a website or web shop. More roles, more endpoints or a larger application make the test bigger. Once the scope is agreed you get a fixed price.
A scan looks automatically for known flaws. A pentest searches by hand for flaws in logic, permissions and integrations that a scanner misses.
No, everything can be done by email. Sometimes a short call helps to sharpen the scope. It is then scheduled together.
By arrangement, usually within two weeks of the scope being fixed. No test environment? HackIndex sets one up.
Within 2 working days of your request. The report follows within 10 working days of the test.
A test account per role and a fixed point of contact. No test environment? Then access to your hosting or a backup is enough, HackIndex sets up the copy. For white box also the source code and documentation.
Yes. You need no test environment or technical knowledge. HackIndex comes from software development and sets up a safe copy of your site itself, so your live site runs no risk. For common sites, such as WordPress, WooCommerce and Laravel, at no extra cost.
Your own developer or agency: the report is written for that, with a fix for each finding. If you have nobody, HackIndex can fix them as a separate assignment at extra cost, for apps in Laravel, WordPress, WooCommerce, Magento, another PHP framework, Node.js or Python.
Critical findings are reported right away, not only in the report. That way you can act immediately.
Confidentiality is agreed in advance in an NDA. Reports are shared encrypted.
Briefly describe what needs testing. You'll receive a proposal with a fixed price.
