Questions beforeyou request a test

No. You can request the assessment, answer scope questions, accept the quotation, and follow the project in writing. A call is optional if you later ask for one.

The application URL, the API type, how users sign in, the roles to compare, the environment, and why you need the test. An OpenAPI or Postman file helps. Do not send passwords or tokens on the form.

After the scope review, ScnFix sends a written quotation in INR or USD. It names the targets, boundaries, test accounts, methods, duration, deliverables, retest, and the agreed schedule. You receive it before signing the rules of engagement.

After you approve the quotation and the rules of engagement. Submitting the form does not start a test, and paying an invoice does not start a test.

The quotation states the agreed schedule for that engagement. Customer delays, missing test accounts, and scope changes are written into a revised schedule. This site does not promise a fixed number of days.

No. The report and the completion letter describe the authorised test and its limits. They are not a SOC 2 certificate, an ISO certificate, a guarantee that the application is secure, or a formal compliance attestation.

Only when production is named in the authorised scope. Staging is the usual choice. Destructive tests and denial-of-service tests stay out unless the rules name a specific exception.

ScnFix assigns a testing team to the authorised engagement. The work covers the engagement lead, web testing, API testing, and report review. Testers are assigned per project. We do not publish a headcount or personal credentials.

Standard includes one retest of findings from that report after you remediate them, inside the window on the quotation. A note that an issue is fixed is not the result. A reviewer records whether the fix holds.