Password, hash, and site-security checkers to keep things locked down.
One call. An honest scope, a real timeline, and weekly updates until it ships.