Services
Application security: review and implementation
We find the gaps in your application and close them in the code: who can see what, how users sign in, where secrets live, what is logged and how you recover. For new and existing web and mobile apps, including those built by other vendors or with AI tools.
What does application security implementation include?
Application security implementation means building protections into the software itself: access control checked on the server for every request, secure sign-in with two-step verification, secrets kept out of code, input validation, rate limits, encryption in transit and at rest, security headers, dependency updates, backups that are tested, and logs that record who did what. Infovion Technologies reviews existing web and mobile applications against the OWASP Top 10 and ASVS, fixes what it finds, and builds these controls into new software. It is not a CERT-In-empanelled auditor: where a certified audit is required, it fixes the auditor's findings and supports the retest.
Updated 5 November 2026 by Infovion Technologies, Pune.
Scope
What we deliver
Security review
Code and configuration reviewed against the OWASP Top 10 and the ASVS, with each finding rated and explained.
Access control
Roles and permissions checked on the server for every request, so users only reach their own data.
Secure sign-in
Proven authentication, two-step verification, safe password storage, session expiry and account lockout.
Secrets and configuration
Keys moved to a secrets store, rotated where exposed; security headers, HTTPS and CORS set correctly.
Data protection
Encryption in transit and at rest, personal data minimised, backups tested, retention and deletion built in.
Logs and incident readiness
Audit logs, alerts on suspicious activity and a written plan for reporting and recovering from an incident.
The most common gaps we find
- Broken access control: one user reaching another's records by changing an ID, the top risk in the OWASP Top 10
- Admin actions protected only by hiding the button
- Secret keys in code or in the browser
- No rate limits on login, OTP and password reset
- Old libraries with known vulnerabilities
- Logs that are missing, or that store passwords and OTPs
- Backups nobody has ever restored
Indian rules that touch application security
- DPDP Act, 2023: a business handling personal data must take reasonable security safeguards; penalties go up to ₹250 crore
- DPDP Rules, 2025, notified on 13 November 2025: most obligations apply from May 2027
- CERT-In directions of 28 April 2022: report specified cyber incidents to CERT-In within 6 hours of noticing them
- The same directions: keep ICT system logs for a rolling 180 days, within India
Security review or certified VAPT?
A security review finds and fixes weaknesses in your code and setup. A VAPT report from a CERT-In-empanelled auditor is what government departments, banks and many enterprise clients ask for as proof. Infovion is not on the CERT-In empanelled list. Many clients have us review and fix first, then take the certified audit, which we support through fixes and retesting.
Sources: OWASP Top 10 · OWASP Application Security Verification Standard · OWASP Password Storage Cheat Sheet · MeitY: Data protection framework (DPDP Act and Rules) · CERT-In directions under section 70B(6), 28 April 2022
Deliverables
- Security review report with findings rated by severity
- Fixes in your code, each linked to a finding
- Roles and permissions matrix
- Secrets moved and rotated, headers and HTTPS configured
- Backup and restore test, logging and alerting set up
- Incident response checklist for your team
Typical clients
- Apps holding customer or student personal data
- Businesses preparing for a client's security questionnaire
- Startups before fundraising or an enterprise deal
- Apps built quickly or with AI tools
- Teams with findings from an audit to fix
Technologies
OWASP ASVS, Node.js, NestJS, Next.js, React Native, PostgreSQL, Supabase, Firebase, AWS, Cloudflare, Vercel
Cost and timeline
Cost of application security in India
Indicative budget ranges for the Indian market in 2026, provided for planning. Each project receives its own fixed-price proposal after an initial consultation.
| Project type | Typical budget |
|---|---|
| Security review of an existing app | ₹30,000 – 1 lakh |
| Implementing fixes | ₹50,000 – 3 lakh |
| Ongoing security updates | Included in a maintenance AMC |
Timeline. Review in one to two weeks; fixes in two to six weeks depending on findings.
Factors that affect cost
- Number of user roles, screens and APIs
- Personal or financial data held
- Mobile apps in addition to the web app
- Integrations and third-party services
Process
How the project is delivered
01Week 1
Discovery
An initial consultation, followed by a requirements workshop for larger projects, to understand processes, users and objectives.
02Within 2 business days
Proposal
A written scope, milestone plan and fixed-price proposal, so cost and timeline are agreed before work begins.
031–3 weeks
Design
Wireframes and a clickable prototype reviewed with your team before development starts.
042-week sprints
Development
Fortnightly releases to a staging environment, with a review at the end of each sprint.
051–2 weeks
Testing and launch
Functional and security testing, user acceptance testing, data migration, training and go-live.
06Ongoing
Support
Thirty days of post-launch support, followed by an optional maintenance contract.
FAQ
Frequently asked questions
What is the difference between a security review and VAPT?
A security review looks at the code and configuration to find and fix weaknesses. VAPT (vulnerability assessment and penetration testing) tests the running app from outside, and a report from a CERT-In-empanelled auditor is often required by government and enterprise clients. We do reviews and fixes, and support certified audits; we do not issue CERT-In audit certificates.
Does the DPDP Act apply to my app?
If the app collects personal data of people in India, such as names, phone numbers, emails or student records, the DPDP Act, 2023 applies. Most obligations under the DPDP Rules, 2025 apply from May 2027. Take legal advice on your exact duties; we implement the technical side, such as security safeguards, consent records and deletion.
How quickly must a cyber incident be reported in India?
CERT-In's directions of 28 April 2022 require specified cyber incidents to be reported to CERT-In within 6 hours of noticing them, and ICT system logs to be kept for 180 days within India.
Can you secure an app another vendor built?
Yes. Most of our security work is on software built by others or with AI tools. We start with a review and fix the most serious findings first.
What is the OWASP Top 10?
A list, published by the OWASP Foundation, of the most critical security risks to web applications. Broken access control is at the top. It is the usual baseline for a security review; the OWASP ASVS gives a more detailed checklist.
Related services
Services often combined with this one
Discuss your application security requirements
Share a brief description of your project. We respond within one business day with questions, an approach and a fixed-price proposal where the scope allows.