Email change security review cost: $2,400, you own it

Email change security review cost is $2,400 once for one app whose signed-in users can move the account to a new email. $1,200 starts the work. The report is due 48 hours after that change works on a test user. You own the PDF. There is no subscription. The inbox is the identity. The password can stay the same.

Short answer: Email change security review cost is $2,400 once, with $1,200 to start, for one app that lets a signed-in user move the account to a new email. I check that the old inbox is told, that the new inbox confirms before the login address moves, and whether yesterday’s session still works. The report lands 48 hours after access works. You own it. A vendor’s email product and a multi-week accredited pentest are different purchases. The offer is the web application security review.

What does an email change security review cost?#

Email change security review cost is $2,400 once for one app and $1,200 to start, with the rest due when the PDF lands. You own that file. You are not buying a Supabase plan, a Clerk seat, a scanner subscription, or a certificate I do not hold.

OWASP’s email cheat sheet says changing an email is changing identity: re-authenticate, tell the current inbox, and confirm the new one. Supabase confirms both addresses by default. Turn Secure email change off and only the new inbox confirms. Clerk re-checks the user within 10 minutes before a prebuilt component adds, removes, or sets a primary email. Auth0’s email verification ticket lasts 432,000 seconds (5 days) when the lifetime is unset or 0. That ticket verifies an address. It is not your change flow.

What you are buying	What the docs say	What you actually get
Supabase email update	Both inboxes confirm, unless Secure email change is off	Their control. Your API can still move the address early
Clerk add, remove, or set primary email	Re-check within 10 minutes on prebuilt components	Their UI. Your API still has to enforce the same window
Auth0 email verification ticket	5 days if the lifetime is unset or 0	A URL that verifies an address. Not your change flow
This review	$2,400 once, $1,200 to start	One app, the email move and what still works after it, report in 48 hours, one retest
Manual web app or API test	$2,500–$5,500	Longer calendar, wider scope, exploitation evidence in the report

Pentestica, updated 2 October 2026, lists a manual web app or API test at $2,500–$5,500, and that report includes exploitation evidence. Mine does not.

Two passes of this review, a year apart, are $4,800 over 24 months. Three are $7,200 over 36 months.

The same $2,400 is on pricing. If the product is a SaaS app with customer accounts, the industry page is website security review for SaaS. A link that replaces the password is a different writeup: password reset security review cost.

What does that $2,400 actually check?#

I request the change on a test account you give me and record whether the login email moves before the new inbox confirms it. The pass covers the live messages, the confirmations, and the sessions already open. I do not ship a recipe for forging a link.

I record, in plain findings:

• Whether the user must sign in again before the change starts.
• Whether the old inbox is told before the login email moves, and whether that inbox can stop it.
• Whether the new inbox must confirm before the stored address changes.
• Whether an older confirmation still works after a newer request.
• Whether sessions already open still work after the address moves.

The document shape is the sample pentest report. No client names. No exploit steps. No token values.

Supabase’s send-email hook warns that the two confirmation hashes are easy to attach to the wrong inbox. I record which inbox got which proof. I do not print the field map.

What is not included for $2,400?#

You get severity, path, role, and a fix an engineer can ticket, for one authorized app. I do not ship exploit steps, a Supabase project audit, a second app, or a certificate I do not hold. The PDF is yours. There is no monthly fee.

If the email replaces the password and the address stays put, that is the password-reset post. If the email only signs the user in, that is magic link security review cost. A signup confirmation on a new account is a different quote.

This is not AI Front Door, where a customer books or pays from ChatGPT, Claude, Grok, or another AI app that supports MCP connectors. MCP is the open standard those apps use to connect to a business’s tools. It is not Workflow Automation either. That offer is $3,500 once for one repeating ops job, such as an invoice chase, and it does not test an email change.

How does the review run from the change request to the PDF?#

You authorize one URL, I use the test account you send, and the clock starts when I can request the change. Your API decides whether the old inbox can stop it. I do not patch production at this price.

Step	What happens
Trigger	Users can already move the account email, or a buyer asked what happens if the old inbox never hears about it
Action	I request one change and record which inbox can still sign in
System of record	The app, plus severity, path, role, and a fix
Human escalation	You ticket the change. I do not edit production inside this price

Send written authorization and one test user who can receive both messages. Say whether the old inbox must approve. One free retest of that same URL is included within 14 days.

When this isn’t the right move yet#

Do not pay the $1,200 if nobody can change the account email today, or if I cannot legally open the app. A pass with no change flow is a normal login skim. Ship the change, then book the review.

Wait if the new address is still a support ticket. Hire the firm that holds CREST if the questionnaire requires that name. If the email only sets a new password, read the password-reset post instead of buying this one twice. A missed phone is the receptionist, $8,000 once, not this review.

What should be true before I start?#

Bring the URL, one test user, and one sentence on whether the old inbox must approve. I can start without a tour of your email vendor. I cannot start on a change that does not behave like production.

Before you pay, write this down:

• Whether a signed-in user must re-enter a password or a second factor before the change starts.
• Whether the old inbox is notified, and whether that inbox can cancel.
• Whether the stored login email moves only after the new inbox confirms.
• Whether open sessions must die when the address moves, and which inbox receives the next password reset.

If you want the layout before credentials, ask for the sample from the contact form.

$1,200 reserves the work on the review page. I confirm scope in writing before I start. The form is short. I reply with the replacement map within 24 hours. If you would rather talk through the workflow for 20 minutes and see whether this fits, book a 20-minute call.