Password reset security review cost: $2,400, own it

Password reset security review cost is $2,400 once for one app whose users set a new password from an email. $1,200 starts the work. The report is due 48 hours after that reset works on a test user. You own the PDF. There is no subscription. The link replaces the password.

Short answer: Password reset security review cost is $2,400 once, with $1,200 to start, for one app that lets a user set a new password from an email link. I check that the link dies after one success, how long an unused link still works, and whether old sessions survive the change. The report lands 48 hours after access works. You own it. A vendor’s reset product and a multi-week accredited pentest are different purchases. The offer is the web application security review.

What does a password reset security review cost?#

Password reset security review cost is $2,400 once for one app and $1,200 to start, with the rest due when the PDF lands. You own that file. You are not buying an Auth0 seat, a Supabase plan, a scanner subscription, or a certificate I do not hold.

The table uses published lifetimes, not guesses. Auth0 makes the emailed link one use and expires the session on reset. Auth0’s ticket API defaults to 432,000 seconds (5 days) when the lifetime is unset. Supabase defaults recovery links to one hour, and its password guide does not reveal whether the address exists.

What you are buying	2026 price	What you actually get
Auth0 emailed password reset	One use; newest email wins; session expires	Their product. URL lifetime is a dashboard field
Auth0 password-change ticket	5 days if the lifetime is unset	A URL you mint. Not a test of your reset API
Supabase recovery link	1 hour default, same timer as magic links	Their control. The call hides whether the address exists
This review	$2,400 once, $1,200 to start	One app, the reset and what still works after it, report in 48 hours, one retest
Manual web app or API test	$2,500–$5,500	Longer calendar, wider scope, exploitation evidence in the report

WardenBit’s 2026 guide puts most web app projects between $2,500 and $15,000, and $100–$3,000 on mostly automated scanning. Pentestica, updated 2 October 2026, lists a manual web app or API test at $2,500–$5,500. Mine does not include exploitation evidence.

Two passes of this review, a year apart, are $4,800 over 24 months. Three are $7,200 over 36 months.

The same $2,400 is on pricing. If the product is a SaaS app with customer accounts, the industry page is website security review for SaaS. A sign-in email is a different writeup: magic link security review cost.

What does that $2,400 actually check?#

I request the reset on a test account you give me, set a new password once, and record what still works. The pass covers the live reset email, the link, and the sessions that were already open. I do not ship a recipe for forging a link.

OWASP’s testing guide says a used link should die, and an unused link should rarely live more than an hour. The forgot-password cheat sheet says the reply should match for an unknown address, the token is single-use, and the reset should not log the person in. A homegrown handler often changes the password and leaves yesterday’s browser logged in.

I record, in plain findings:

• How long an unused reset link still works, against the lifetime you think you set.
• Whether the same link still sets a password after one success.
• Whether an older reset email still works after a newer one is sent.
• Whether sessions that were already open still work after the password changes.
• Whether “send the reset” answers the same for an address that is not a user.
• Whether the link’s host is the app you named, and whether the reset skips a second factor the normal login requires.

The document shape is the sample pentest report. No client names. No exploit steps. No token values.

What is not included for $2,400?#

You get severity, path, role, and a fix an engineer can ticket, for one authorized app. I do not ship exploit steps, an Auth0 tenant audit, a second app, or a certificate I do not hold. The PDF is yours. There is no monthly fee.

If the email signs the user in and never changes a password, that is the magic-link post. A token that mints access is a later pass: refresh token security review cost. Changing the account email is a different quote.

This is not AI Front Door, where a customer books or pays from ChatGPT, Claude, Grok, or another AI app that supports MCP connectors. MCP is the open standard those apps use to connect to a business’s tools. It is not Workflow Automation either. That offer is $3,500 once for one repeating ops job, such as an invoice chase, and it does not test a reset email.

How does the review run from the reset email to the PDF?#

You authorize one URL, I use the test account you send, and the clock starts when I can request the reset. Your API decides whether the old password and the old sessions die. I do not patch production inside this price.

Step	What happens
Trigger	Users already reset from email, or a buyer asked if yesterday’s browser still works
Action	I request one reset and record what the next call still accepts
System of record	The app, plus severity, path, role, and a fix
Human escalation	You ticket the change. I do not edit production inside this price

Send written authorization and one test user that can receive the reset. Say whether open sessions must die. One free retest of that same URL is included within 14 days.

When this isn’t the right move yet#

Do not pay the $1,200 if nobody can reset a password from email today, or if I cannot legally open the app. A pass with no reset link is a normal login skim. Ship the reset, then book the review.

Wait if the email is still a ticket. Hire the firm that holds CREST if the questionnaire requires that name. If the email signs the user in and never changes a password, read the magic-link post instead of buying this one twice. A missed phone is the receptionist, $8,000 once, not this review.

What should be true before I start?#

Bring the URL, one test user, and one sentence on how long you believe the reset lives. I can start without a tour of your email vendor. I cannot start without a reset that behaves like production.

Before you pay, write the list:

• The lifetime you intend, in minutes, for an unused reset link.
• Whether a second click must fail, and whether an older email must fail after a newer one.
• Whether open sessions must die when the password changes, and whether the reset may log the user in.
• The host the link is allowed to open, and whether a second factor still has to run.

If you want the layout before credentials, ask for the sample from the contact form.

$1,200 reserves the work on the review page. I confirm scope in writing before I start. The form is short. I reply with the replacement map within 24 hours. If you would rather talk through the workflow for 20 minutes and see whether this fits, book a 20-minute call.