Authentication security review: login is the product
An authentication security review looks at login, reset, invite, roles, and session — the work most web app buyers actually need.
If strangers can create an account, authentication is the product.
An authentication security review that only looks at headers on the marketing site is a waste of a week.
Short answer: Auth is in the standard web application security review: $2,400, $1,200 to start, 48 hours after the test user signs in.
Surfaces
Login and lockout behavior you already expose. Reset and invite mail. SSO assertion mapping. Session lifetime. Role checks after the cookie is set.
I do not need your IdP tenant admin. I need a user that works.
How findings are written
Severity, path, expected control, practical fix. No credential leftovers in the PDF. See the sample.
Pay on the offer page. The same split is on pricing.
FAQ
What is an authentication security review? +
Authorized testing of login, SSO, password reset, invites, role checks, and session cookies or tokens on one application.
Is auth included in the $2,400 offer? +
Yes. Frontend, auth, and API are one pass on one URL. Extra apps are quoted.
Do you need a second role? +
It helps. I can still review a single role. Say so in the authorization note.
