Harden Social Media Web App

I need a seasoned vulnerability researcher to comb through my social-media-style web application and surface every exploitable path to Cross-Site Scripting (XSS) or Cross-Site Request Forgery (CSRF). The codebase is a typical React front-end served by a Node/Express API with a MongoDB backend, all containerised in Docker and running behind Nginx.

Scope
The engagement covers the full production replica: unauthenticated, authenticated, and privilege-escalation flows, including upload modules, messaging, profile edits, and any third-party integrations. Only web vectors are in scope; mobile clients and network infrastructure scanning are out of scope for now.

Methodology
Feel free to bring your own toolkit—Burp Suite Pro, OWASP ZAP, custom scripts, browser dev-tools extensions—so long as findings are reproducible. I will supply you with test accounts, API keys, source maps, and a staging URL.

Deliverables
• A concise report for each verified XSS or CSRF issue, detailing:
 – Step-by-step reproduction (with screenshots or PoC scripts)
 – Impact assessment (data theft, account takeover, etc.)
 – Recommended remediation or patch code snippet
• A final executive summary ranking all issues by criticality (OWASP severity scale).
• Optional follow-up retest once fixes are deployed (counted as a separate milestone).

Acceptance Criteria
A deliverable is accepted when the provided PoC reliably triggers on the current staging build, the write-up is clear enough for my devs to reproduce, and the remediation advice is technically sound.

Timeline
Initial findings expected within one week of access; complete report within two.

If this fits your skillset, let’s get you into the environment and start breaking things—before the bad actors do.