I will do penetration testing and audits

I use careful, controlled testing methods designed to identify vulnerabilities without disrupting your live site. However, for production environments, I recommend testing on a staging/clone if available. I'll discuss this with you before starting if it's a concern.

Yes. Everything discovered during testing is confidential and shared only with you. I'm happy to sign an NDA if required (let me know in advance).

I manually test for the OWASP Top 10 vulnerabilities — SQL Injection, Cross-Site Scripting (XSS), Broken Authentication, Security Misconfigurations, IDOR, CSRF, and more — depending on your package. I combine manual testing with automated tools for thorough coverage.

If your site has user accounts/login areas, providing test credentials allows me to test authenticated areas (often where the most serious bugs hide). If you'd rather not share real account credentials, I recommend creating a temporary test account for me.

A detailed PDF report including: each vulnerability found, severity rating (Critical/High/Medium/Low), step-by-step reproduction instructions, evidence (screenshots), business impact explanation, and remediation recommendations.

My focus is on identification and reporting, not remediation/development work. However, I can recommend specific fixes, and for select cases I may be able to assist with implementation — message me to discuss.