Low-budget grey-box pentest for a small Amazon SP-API integration (verifiable CEH/OSCP/CREST required)

I'm a solo developer with a small, self-built integration for the Amazon Selling Partner API. Amazon requires a penetration test by a certified tester (Data Protection Policy). The project is small, source code and documentation are provided, and my own scans show no open Critical or High findings...