Skip to content
SHEA GLOBAL
--:--:--

SHEA GLOBAL · Cloud & DevOps

Software Modernization & Security Hardening

This package assesses one application, addresses selected security priorities, applies compatible dependency updates, and refactors up to two modules while preserving agreed business behaviour.

FIXED PRICERp85.000.000Fixed pricing applies only to the signed scope. AWS usage, hosting, domains, paid certificates, provider APIs, licenses, taxes, and other third-party expenses are separate unless expressly contracted.

Is this service right for you?

Improve important parts of an older application without carrying out a complete rebuild.

This package assesses one application, addresses selected security priorities, applies compatible dependency updates, and refactors up to two modules while preserving agreed business behaviour.

Is this service right for you?

Owners of an application that still works but is difficult to maintain, uses older dependencies, or has security findings that need prioritisation.

When this service becomes useful

The service is useful before an important release, after an assessment identifies risks, or when small changes are becoming difficult to make safely.

Where the solution is used

Work is carried out in one approved repository and test environment. Production release still follows a separate approval and rollback plan.

How the project moves forward

We begin with the business need, not with a technology we want to sell.

  1. 1

    Perform a read-only assessment of architecture, dependencies, testing, and risks.

  2. 2

    Agree on the findings to address and up to two modules to refactor.

  3. 3

    Apply compatible changes and run regression and performance checks.

  4. 4

    Hand over the change record, before-and-after evidence, residual risks, and rollback plan.

Included in the package

Customer Outcome

Improved maintainability and security for one existing application without changing business behavior outside the agreed scope.

Included in the packageIncluded capability category
Agreed before the project beginsImplementation parameter to agree in writing
Available for separate discussionNot included without further approval
Not includedOutside the base package

Approved Core Capabilities

Agreed before the project begins
Included in the package

Read-only Baseline Assessment

Application inventory and prioritized risk review.

Agreed before the project begins

Repository/branch, runtime, dependency versions, architecture, test coverage, and security constraints.

Included in the package

Security Priority Fixes

Remediation of selected vulnerabilities.

Agreed before the project begins

Finding, severity, exploitability, remediation plan, and acceptance; the final list is locked.

Included in the package

Compatible Dependency Updates

Compatible dependency upgrades.

Agreed before the project begins

Version matrix, breaking-change assessment, lockfiles, regression checks, and rollback.

Included in the package

Refactor up to 2 Modules

Code-structure improvements in two modules.

Agreed before the project begins

Module boundaries, interfaces, test coverage, behavior preservation, and performance baseline.

Included in the package

Authentication & Config Hardening

Review of relevant security controls.

Agreed before the project begins

Access permissions, secrets, headers, session policy, input validation, and only agreed items.

Included in the package

Basic Performance Checks

Baseline and result comparison.

Agreed before the project begins

Selected endpoint response time, resource utilization, test conditions, and bottleneck evidence.

Included in the package

Regression Testing

Verification that critical functionality remains intact.

Agreed before the project begins

Critical user journeys, role permissions, failure scenarios, and automated/manual evidence.

Included in the package

Rollback & Release Plan

Recovery path if changes cause problems.

Agreed before the project begins

Backup, release artifact, feature flags where available, revert steps, owner, and approval gate.

Included in the package

Technical Handover

Change record and residual-risk transfer.

Agreed before the project begins

Change log, fixed/not-fixed matrix, residual risks, QA evidence, and owner acceptance.

Included in the package

Package Boundaries

One application and no more than two refactored modules.

Not included

Exclusions

  • Total rewrite, UI redesign, major replatforming, and a guarantee that every vulnerability is removed.
  • ISO/SOC 2 certification, independent penetration testing, 24/7 monitoring, and unlimited remediation.
Included in the package

Deliverables & Handover

  • Assessment report and prioritized risk register.
  • Selected fixes, compatible dependency updates, and refactoring of up to two modules.
  • Regression QA, performance comparison, rollback plan, and technical handover.

External Costs

AWS usage, provider APIs, hosting, domains, paid certificates, licenses, external audits, taxes, and other third-party expenses are itemized separately. Ongoing cloud costs after handover remain the responsibility of the agreed owner.

Included in the package

QA & Acceptance

  • Baseline measurements completed before changes.
  • Before-and-after evidence for every selected vulnerability.
  • No regression in agreed critical journeys; dependency updates tested with rollback available; production release requires approval and verified backup.
Available for separate discussion

Proposed Value-add

  • Dependency risk register
  • Secure release checklist
  • Post-release stability observation proposal

No package-specific add-on or recurring maintenance price is published here. Additional scope requires verified price-book authority, an approved SLA where applicable, and written approval.

Included in the package

90-day Bug Warranty

For 90 days after Final Acceptance, reproducible implementation defects against the approved written scope are covered. Feature requests, provider changes, external incidents, and unauthorized changes require change control. Production deployment, restart, database, IAM, DNS, and cutover actions require separate explicit authorization.

Agreed before the project begins

Additional Scope

No package-specific add-on or recurring maintenance price is published here. Additional scope requires verified price-book authority, an approved SLA where applicable, and written approval.

Explore other digital services →

Discuss your requirements

Discuss your requirements

Tell us which process you want to improve, who will use the solution, and what result you need. We will help identify the most suitable package before preparing a written scope.