Contact
I reply by email with questions, then a written quote.
For an assessment: the domains, apps or APIs you want checked, who hosts them, whether you can authorize testing, and your timing. Names only.