Security / Web, app & API
Web application security assessment in Vietnam
Friday Works is registered in Ho Chi Minh City, Vietnam and provides fully remote web application security assessments for websites and APIs. Each engagement covers the attack surface, configuration, authentication, authorisation and important business flows within an agreed scope. Findings focus on reproducible evidence, real impact and a remediation order the engineering team can act on.
- Indicative budget
- 8–20 million VNDOne application, up to two roles and twenty in-scope APIs
- Timeline
- 1–2 weeksCorporate websites often take days; more roles take longer
- Retest
- One within 30 daysConfirms that findings have been fixed
- Authorisation
- In writingScope, test accounts and prohibited actions agreed before testing
Common problems
What businesses usually ask us to solve
Situation 01
Launch is close, but nobody has tested permissions between account types.
How Friday Works responds
We manually test each role: can one user view or change another user's data, and can a regular account reach administrative functions?
Situation 02
A scanner produced hundreds of warnings and nobody knows which are real.
How Friday Works responds
Tool output is only a signal. Every finding in the report is verified with reproducible evidence, and false positives are removed.
Situation 03
The engineering team receives a report but does not know where to start.
How Friday Works responds
Findings are prioritised by real impact, with remediation suited to the architecture and a walkthrough where the team can ask questions.
Situation 04
Customers or partners ask whether the system has had a security review.
How Friday Works responds
The report states the scope, dates, method and status after retest. It is a scoped technical assessment, not a compliance certification.
Project types
Projects we typically take on
Before launch
Review important controls before a website or application receives real users and data.
After a major change
Check sign-in, authorisation, payment, upload or API flows following a significant release.
Establish a baseline
Create a prioritised risk and remediation backlog for a system that has not had a structured review.
When should you run a security assessment?
A good fit when
- Before a website, web app or API receives real users and data.
- After major changes to sign-in, authorisation, payments, uploads or APIs.
- When a test environment and test accounts exist for each role in scope.
Not a fit when
- You need infrastructure, internal-network or DDoS testing, or a full Red Team programme.
- You need a compliance certificate instead of a technical review, or the system owner has not authorised testing.
How we work
Step by step: who does what and what you receive
Example schedule for one web app with up to two roles and twenty in-scope APIs (package B01, about 1–2 working weeks). Corporate websites are usually shorter; several applications or roles need more time.
- 01Before testing
Scope & authorisation
Every check stays inside a written scope and authorisation.
Friday Works does
- Agree the domains, applications, APIs, user roles and testing window.
- List prohibited actions and the incident contact.
- Agree report recipients and how long test data is retained.
Your part
Confirm system ownership and provide test accounts and a test environment.
You receive
- A scope and rules-of-engagement document
- Test schedule and quotation
CheckpointSign the proposal and testing authorisation and pay the first instalment.↗︎
- 02Days 1–2
Application mapping
Understand the application as real users do before forming hypotheses.
Friday Works does
- Walk through the application with each agreed role.
- List endpoints, sign-in flows, permissions, uploads and integrations.
- Select high-risk areas for deeper testing.
Your part
Share API documentation (if any) and the most important business flows.
You receive
- A map of the test surface
- A prioritised list of hypotheses
- 03Days 2–7
Controlled testing
Technical review combined with low-impact manual checks.
Friday Works does
- Test authentication, sessions and account recovery.
- Test authorisation by role and by individual data object.
- Test input handling, uploads, configuration and business logic.
- Record a baseline and negative control for every hypothesis; alert the contact immediately on serious risk.
Your part
Keep a technical contact available and avoid major changes during the window.
You receive
- Evidence for each finding
- Early alerts for serious findings
- 04Days 7–10
Report & walkthrough
A report the engineering team can use immediately, not a raw list of warnings.
Friday Works does
- Write an executive summary and a prioritised list of findings.
- Give each finding context, minimal evidence, impact and remediation direction.
- Present online to the engineering team and answer questions.
Your part
Invite the people who will fix the issues to the walkthrough.
You receive
- The assessment report
- A technical walkthrough session
CheckpointReport delivered.↗︎
- 05Within 30 days
Remediation, retest & close
Confirm what has been fixed and close the engagement cleanly.
Friday Works does
- Retest the agreed findings once your team has remediated them.
- Update the status of every finding in the report.
- Revoke test accounts and handle test data within the agreed retention period.
Your part
Remediate by priority and tell us when you are ready for the retest.
You receive
- An updated report after retest
- Recommendations for the next assessment
CheckpointAcceptance and the final instalment.↗︎
Deliverables
What you receive
Scope & safety
- Scope and rules of engagementAssets, roles, testing window and prohibited actions, confirmed in writing.
- Test-surface inventoryThe endpoints, flows and functions included in the assessment.
- Data-handling agreementReport recipients, masking and retention period.
Assessment report
- Executive summaryOverall risk and what to fix first, in non-specialist language.
- Evidence-based findingsConditions, safe reproduction steps, negative control and observed impact.
- Priorities and remediationOrdered by real impact and suited to the current architecture.
- CoverageThe controls reviewed, including areas where no issue was found.
Remediation support
- Technical walkthroughThe cause and the fix for each finding, explained.
- One retest within 30 daysConfirms that agreed findings were fixed correctly.
- Status updateWhich findings are closed, still open or accepted as risk.
Methods and reference tools
The exact stack is chosen for each project and recorded in the proposal rather than forcing one platform onto every problem.
- OWASP ASVS, WSTG and API Security Top 10Used to structure coverage, then adapted to the actual architecture and business flows.
- Tool-supported manual reviewBrowser DevTools, testing proxies and scripted checks; tool output never becomes a finding by itself.
- Reproducible evidenceEvery finding states the condition, safe reproduction steps and a negative control.
- Minimal data handlingSensitive data is limited, masked or encrypted throughout.
Collaboration
What both sides prepare
What you prepare
- Confirmation of ownership or authorisation for every asset tested.
- A test (staging) environment or a safe window on production.
- Test accounts for every role in scope.
- API documentation and descriptions of important business flows, if available.
- A technical contact and an incident contact during testing.
What every finding in the report must have
- A clear condition, safe reproduction steps and a negative control.
- Priority based on real impact, not only a tool's score.
- Minimal evidence, with no real sensitive data in the report.
- Every check inside the authorised scope and window.
- Automated tool results verified manually.
- Remediation specific enough for developers to act on.
Pricing
Indicative packages and how the budget is set
Related starting packages
Version 20 October 2026 · Unit: million VNDWeb / API security assessment
8–20million VND / assessment
Estimated: 1–2 weeks
Baseline scope. One application, up to two roles and twenty in-scope APIs; authentication/authorisation and core-flow review; evidence-based report, remediation priorities and one retest within thirty days.
Not included: Full source review, DDoS, internal infrastructure/network testing or compliance certification.
These are indicative budgets for new engagements, not fixed quotations or prices from completed contracts. Scope, schedule and cost are confirmed for each project before work begins.
Typical timelines
- Corporate website
- Often several working days when scope, access and environment are ready.
- Web application or API (B01)
- Often 1–2 weeks for one application with up to two roles and twenty APIs; larger scopes can take 2–3 weeks.
- Confirmed scope
- Set only after the assets, functions and safe operating constraints are understood.
The budget depends on
- The number of domains, applications, API endpoints and user roles.
- Authentication, authorisation and business-logic complexity.
- Environment, account, testing-window and incident-coordination needs.
- Reporting detail, workshop and retest scope.
Proposed payment schedule
- 40%Project start
- 40%Demo & core features
- 20%Acceptance & handover
Before a quote is final
- Agree the page, feature, data and acceptance-criteria list before implementation.
- The schedule starts after scope approval, receipt of required inputs and the first payment.
- The proposal includes three months of defect correction for Friday Works' implementation after acceptance.
- Domain, hosting, email, AI/API, data, licences, third-party services and applicable tax are shown separately.
After handover
Warranty, maintenance and next steps
One retest within 30 days
After your team remediates, Friday Works retests the agreed findings and updates their status in the report. Larger scopes or recurring reviews are quoted separately.
Frequently asked questions
Before we begin
01What is a website security assessment, and how is it different from a vulnerability scan?
A website security assessment reviews configuration, attack surface, authentication, authorisation and important business flows within an agreed scope. Automated scanning is a useful source of signals, while a contextual assessment also validates hypotheses with controlled checks, removes false positives and prioritises findings by practical impact.
02What determines the cost of a website, web app or API security assessment?
Security assessment cost depends on domains, applications, API endpoints, user roles, authentication and authorisation complexity, business-flow depth, the test environment, reporting requirements and retest scope. Pricing is confirmed after the assets, safe operating limits and required evidence are clear.
03Does Friday Works provide web application security assessments from Vietnam?
Friday Works provides scoped web application security assessments from Vietnam; the company is registered in Ho Chi Minh City and operates fully remotely. The assessment scope, authorised assets, test accounts, testing window, communication channel and incident contact are agreed before any controlled testing begins.
04Is this a full penetration test or Red Team engagement?
The Friday Works service is a scoped web app and API security assessment, not a full penetration test or Red Team engagement. If a requirement calls for a full penetration test or Red Team programme, capability, scope and appropriate partners must be confirmed before commitment.
05Will the assessment disrupt the system?
Security assessment testing is designed to be low impact and follows agreed rules. Actions that might alter data or affect service are not performed without an appropriate environment and explicit authorisation.
06Will the report help developers remediate issues?
Friday Works security reports are written for remediation: each finding includes context, minimal evidence, impact and practical remediation direction; the walkthrough lets the team ask questions before retesting.
07Can the report be shared with third parties?
The security assessment report goes only to the recipients agreed in the proposal; the business decides whether to share it with customers or partners. Test-data retention and post-engagement handling are agreed before work begins.
08How often should we run a security assessment?
Run a security assessment before important launches and after any major change to sign-in, authorisation, payments, uploads or APIs. Systems that change frequently benefit from a recurring review rather than a one-off check.
Talk to Friday Works
Understand risk before it becomes an incident
Share the system scope, user roles and a suitable testing window. Friday Works will propose an assessment with clear safety boundaries.
Describe your projectAfter you send a request
- 01Send a short brief
Your goal, current situation and preferred timing; attachments are welcome.
- 02A reply within one business day
Friday Works sends clarifying questions or proposes an online call.
- 03Discuss the scope
Review the goal, risks and an approach that fits the budget.
- 04Receive a written proposal
Scope, milestone schedule, cost and acceptance criteria.