$6k covers about 3 days of effort by a single security auditor, which barely scratches the surface for a large application like NextCloud. Sorry, security is expensive :-/.

You can save yourself some headache by using best practices and clearing away all the low hanging fruit before contracting with an expert. For example, but deploying on HHVM, aggressively using static analysis tools and clearing up issues that lead to compiler warnings, and running external application vulnerability scans from things like local Burp Pro or the hosted Tinfoil Security.

The question was about people running their own webapps. $6k is a reasonable price for a smaller project.

There aren't many non-brochure-ware applications I can imagine getting audited in 3 days. 2 person/weeks is a small app pentest project.

Yeah, I run things on my own. 6k is out of my league. I am surprised this costs so much. Can it not be automated?

Nope. It takes at least a couple months of doing daily pentests to become proficient at finding vulns. As to why it can't be automated, it takes a book to answer that. I'd recommend The Web Application Hacker's Handbook, along with The Tangled Web.

There are things you can do, of course. But unless your app is basically read-only, there are almost always one or two noteworthy vulns.