Cybersecurity pre-audit
Before the official assessment —we close the gaps
We prepare your website, portal or mobile app for the expertise: we find vulnerabilities, fix them and verify the fixes.
Readiness report
15/15
closed
Re-scan: passed
Website
6/6
Mobile app
9/9
Vulnerabilities found
Severity
- High 7
- Medium 1
- Low 1
Mobile app
Top 3 risks
- HighNo root / jailbreak detection
- HighInsecure certificate validation
- HighNo protection against dynamic analysis
Closed findings
Speaking the assessor's language: the standards we follow
- OWASP Top 10
- OWASP ASVS
- OWASP MASVS
- MASTG
- MASWE
- Mobile Top 10
- CWE
What we check
Everything that goes to the expertise
Why Sipar
We've been down this road ourselves
We prepared our own products for the expertise using this exact process. Now we apply that experience to your project.
AI agent + human
A Claude AI agent reviews code, configuration and servers quickly. A specialist checks and confirms every finding.
Based on OWASP and MASVS
OWASP Top 10 and ASVS for web; MASVS, MASTG and MASWE for mobile. The expertise relies on the same standards.
We do the fixes ourselves
We don't just hand over a report: we prepare a patch, a PR or clear instructions for your team.
Re-test included
After the fixes, we check everything again. You keep results that prove the gaps are closed.
Confidentiality and NDA
We sign an NDA and access your code read-only. Your data never leaves the project.
Deep mobile app expertise
Root and emulator detection, certificate pinning, obfuscation, APK/IPA checksums — we've closed these in practice.
Process
Five steps: check, find, close, seal
01
Request and NDA
We define the product, the timeline and the expertise requirements. An NDA is signed.
02
Automated and AI scan
Code, configuration, dependencies, headers and server settings are checked.
03
Manual review
Business logic, authorization, IDOR, file uploads — the places a scanner can't reach.
04
Fixes
A patch, a PR or step-by-step instructions for your team.
05
Re-scan and report
Everything is checked again and a readiness report is delivered.
What the report contains
Everything the assessment needs — in one place
Every finding comes with evidence, a severity level, the fix and the re-test result.
AI agent + expert
The Claude AI agent reviews code and servers fast; an expert confirms every finding.
Every finding closed
Our own product: web 6 + mobile 9.
Host header injection found
High · website · evidence attached
Findings show up right away
We flag critical findings immediately, without waiting for the final report.
Before / after
MASWE · M7<!-- AndroidManifest.xml -->- android:allowBackup="true"+ android:allowBackup="false"+ android:dataExtractionRules="@xml/data_extraction_rules"- android:usesCleartextTraffic="true"+ android:networkSecurityConfig="@xml/network_security_config"
Root detection not implemented
The app runs without restrictions on a rooted device, making memory and traffic analysis easier.
Re-test included
After the fixes everything is checked again — you keep proof that each gap is closed.
Before submission
- Security headers
- Debug mode disabled
- Unneeded ports closed
- APK/IPA checksums
- Re-scan passed
Cases
Let the results speak
Pricing
Packages and pricing
Two tracks: web and mobile app. Choose a scan only, or a scan together with fixing the issues. The cost of fixing depends on the findings and never exceeds the stated cap.
Web scan
Website, portal or API
UZS 5 million
fixed price
- Automated and AI scan
- Manual review by a specialist
- OWASP Top 10, server and header settings
Web scan + fixes
Most popularWe close the issues we find ourselves
up to UZS 50 million
depending on the findings
- Everything in Web scan
- We do the fixes (patch/PR)
- Server and port hardening
App scan
Android (APK) or iOS (IPA) app
UZS 2 million
fixed price
- Static and dynamic analysis per MASVS
- Root/jailbreak, SSL pinning, obfuscation
- Sensitive data storage and traffic
App scan + fixes
We close the issues we find ourselves
up to UZS 15 million
depending on the findings
- Everything in App scan
- We do the fixes
- RASP: protection against root, emulators and Frida
Blog
Practical articles on preparing for the expertise
Questions
Frequently asked questions
Do you issue a certificate?
No. Only the authorized expertise organization issues certificates and conclusions. We prepare your product for that assessment: we find vulnerabilities, close them and verify the fixes.
Is our code safe with you?
We sign an NDA and work with read-only access. Access is revoked as soon as the work is done, and data never leaves the project.
How long does it take?
It depends on the size of the product. Once we get your request, we give you an exact timeline and plan it around your expertise date.
What if it still doesn't pass?
We go through the expertise conclusion together, close the remaining findings and prepare you for resubmission. We don't give a 100% guarantee, but we stay with you to the end.
Will the AI change our code?
No. The AI agent only speeds up the analysis. A specialist reviews and approves every finding and every fix.
Can you test a mobile app without the source code?
Yes, we can test from APK and IPA files too. But access to the source code helps us deliver fixes faster.
Show us before you submit to the expertise
Leave a request: we scan your product and show exactly where the risks are and what it takes to close them.
Request a scan