We have planned to give our web application to a third party vendor,what were the precautionary measures which we need to take care before giving our application to third party vendor?
As the vendor have source access of our web application in order to carry out penetration test there might be application level exploits which might be carried out later by the tested vendor,other than that what were the pre checks which we need to be carried out while handing our web application to security audit ?
If you're contracting with a company to pen test and audit your app, you will be wise to scope out exactly what is in the limits of said test, what will be tested and how (it appears you are giving them source to be able to white-box test as well). They will likely work with you to establish the legal agreements that indemnifies them. It should also spell out the expected outputs, the timeframes and methods they will communicate the results to you. All of these things are just ways to make sure you are getting exactly what you expect from them. This is in their best interest too; they want happy customers as well.
Aside from the legal/contractual matters you would be wise to give them an environment as close to or the same as your production one so that the findings are accurate and also if you can perform your own testing ahead of time to remove the "low hanging fruit"- that is, anything that is easy for them to find. Consider code reviews and system design reviews ahead of time to give them what you think is your best. That way you are getting your money's worth.
If you're worried about giving your source code to a third party, then don't. Bring the third party on-site to perform the code review and don't permit them to take the source code away with them. This also means they can sit with a developer and have responses to any questions they have quite quickly. The developer will also have the opportunity to learn from the reviewer.
For the penetration testing, both credentialed and non-credentialed testing can be done without providing any source code as the tester can test the application interface and logic.