the cost varies widely. $8k - $12k for a "platform" that hires 100% outsourced pentesters of highly variable skill and quality, and takes no liability themselv

the cost varies widely. $8k - $12k for a "platform" that hires 100% outsourced pentesters of highly variable skill and quality, and takes no liability themselves, and whose pentesters are located in developing countries and good luck getting damages out of them, ever, regardless of their platform "reputation" pretend points. also communication tends to be difficult as the norm is ESL. $25k for a US-based boutique firm with in-house pentesters of vetted high quality, who accept liability and against whom you can actually expect to enforce an NDA and/or extract other damages. source code and design audit starts at about this price. then, you can run your own program on top of the bounty platforms, however scope and focused work is not going to happen (a lot of the work is boring), and it will cost you a lot of your own time. the money you save DIY is not worth your own time investment. if you actually want a good pentest, go with a boutique, quality firm. if you want something to give to an auditor or to meet a VSA, go with cheap.