Tell me more ×  For a PHP CMS, what should I expect to budget
for a security audit, both whitebox and blackbox? The codebase
is about 85,000 LOC and I would probably use a North American
company for testing. I really have no idea if an audit would
cost $10-20k or well over $100k. I'm not asking for an exact
quote, just a general guesstimate so that I know what to expect.
If you could separate your estimates between blackbox and
whitebox testing, that would also be helpful.   I'll try to list
as many factors as I can.    • Type of app: A web content
management system similar to Wordpress, Joomla, or Drupal.   •
Types of testing: Broad penetration testing and a scan for
common vulnerabilities. Code review for additional
vulnerabilities as the source code will be publicly available.
• LOC: Roughly 85,000.   • Languages: PHP, JavaScript.   •
Audience for report: Developers.   • Location of testing: It can
be done remotely.   • User roles are variable. They are assigned
to groups and each group can be given any