Comprehensive VAPT & AppSec Audit

I need a full grey-box security assessment covering both the Android and Web versions of my application, all of which run on AWS infrastructure. You will have complete source-code access, so please combine dynamic penetration testing with static code review to uncover anything a traditional black-box approach might miss. Key risk areas to probe: • Data breaches • Authentication flaws • Malware threats • Overall AppSec posture Your work should span OWASP Top 10 techniques, include cloud-specific checks for our AWS setup, and leverage industry-standard tooling such as Burp Suite, OWASP ZAP, MobSF, Metasploit, and relevant AWS security services. Deliverables I expect: 1. A brief test plan outlining scope, tooling, and timelines before you start. 2. A detailed vulnerability report that assigns severity (CVSS), shows clear reproduction steps with screenshots or PoCs, and offers actionable remediation advice. 3. A concise executive summary suitable for non-technical stakeholders. 4. One free round of re-testing after fixes, culminating in a final security attestation letter. Please outline your approach, estimated duration, and any prior experience with similar Android-plus-Web engagements on AWS. Cost is fixed from Bank Side between 15 to 20k