Independent Technical Review for Laravel/PHP SaaS App
Budget / Salary€200–400
TypeFreelance project
LocationRemote
Posted1 hour ago
We are looking for an experienced senior Laravel/PHP developer with strong security and SaaS experience to perform an independent technical review of our web application before we designate the current release as our first stable production release.
This is not a development project.
We do not want someone to modify, refactor or “improve” the codebase during the audit.
We want an experienced external engineer to independently inspect the code and tell us:
What is solid, what is risky, what is broken, and what should be fixed before production?
The goal is an honest third-party assessment.
About the application
We are developing OBRIVO, a Slovenian SaaS/business management platform for companies working in the construction/plastering industry.
The application contains both:
a tenant/customer application
a separate Platform Admin console
The current release candidate is:
OBRIVO 1.1.7
Technology stack includes:
PHP 8.x
Laravel 12
relational database
Laravel queues / database queue
systemd workers
server-side rendered web application / Blade
JavaScript frontend components
authentication
2FA / OTP
role-based authorization
multi-tenant architecture
PDF generation
file uploads/downloads
notifications
background jobs
database migrations
automated tests
release/deployment system
atomic release switching
health checks
signed release packages
The application is already running on a controlled staging environment and has gone through internal functional and E2E testing.
We now want an independent technical review, preferably by someone who has not been involved in the project.
Scope of the review
Please independently review the codebase, with particular attention to the following areas.
1. Authentication
Review:
login flow
password handling
session handling
session regeneration
logout
authentication middleware
remember-me functionality if applicable
password reset
authentication edge cases
brute-force protection
rate limiting
account enumeration risks
2. Two-Factor Authentication
Review:
OTP implementation
OTP verification
session state during 2FA
bypass possibilities
recovery/fallback mechanisms
authorization before and after 2FA
session fixation risks
ability to access protected areas before completing 2FA
Pay particular attention to the Platform Admin authentication flow.
3. Authorization / Access Control
This is one of the most important parts of the audit.
Review whether users can access data or actions outside their permissions.
Check for:
IDOR
insecure direct object references
missing authorization checks
tenant isolation problems
role escalation
privilege escalation
Platform Admin → tenant boundaries
tenant → Platform Admin boundaries
route middleware
controller authorization
policy/gate implementation
API/action-level authorization
We are particularly interested in whether a normal tenant user could ever access another tenant's data or Platform Admin functionality.
4. Multi-Tenancy
Review the architecture responsible for tenant isolation.
Look for:
missing tenant filters
unsafe queries
model scopes
authorization gaps
background jobs executing in the wrong tenant context
queued jobs without sufficient tenant context
accidental cross-tenant data exposure
tenant ID manipulation
indirect access through related models
Please attempt to identify realistic attack paths rather than only checking whether the code “looks correct”.
5. Web Application Security
Review for common vulnerabilities including:
XSS
CSRF
SQL injection
command injection
SSRF
path traversal
insecure redirects
mass assignment
unsafe deserialization
unsafe file handling
authorization bypass
information disclosure
sensitive data exposure
Use OWASP-style thinking where appropriate.
6. File Uploads / Downloads
Review:
uploaded file validation
MIME validation
extension validation
storage location
filename handling
path traversal
authorization when downloading files
ability to access another user's/tenant's files
dangerous file types
direct storage exposure
PDF/document handling
7. Database / Eloquent
Review:
Eloquent queries
raw SQL
mass assignment
relationships
scopes
migrations
indexes where relevant
transaction handling
race conditions
data integrity
tenant filtering
8. Queue / Background Jobs
Review:
queue configuration
job authorization/context
retries
failed jobs
timeout handling
duplicate execution
race conditions
idempotency
worker configuration
sensitive operations performed asynchronously
The application uses a database-backed queue and a systemd worker.
9. Release / Deployment System
The application has a custom release/deployment mechanism.
Please review the relevant deployment code for security and reliability issues, including:
release package validation
SHA-256 verification
release signatures
archive extraction
path traversal
permissions
ownership
atomic current switching
migration ordering
health checks
rollback behavior
concurrent deployment protection
lock handling
environment handling
production-path protection
We do not expect you to redesign the deployment system.
We want to know whether there are serious security or reliability flaws that should prevent production release.
10. Secrets / Configuration
Review:
.env usage
secrets exposure
logging
exception handling
debug mode
sensitive configuration
credentials accidentally committed to Git
application keys
API keys
production error disclosure
11. Dependencies
Review:
Composer dependencies
known vulnerable dependencies
dependency configuration
whether development packages could unintentionally be exposed in production
Please distinguish between:
actual exploitable vulnerabilities
theoretical risks
outdated but non-critical packages
12. Code Quality / Maintainability
We are also interested in:
dangerous patterns
duplicated security-sensitive logic
architectural problems
fragile code
error handling
test coverage gaps
areas likely to cause production incidents
This is secondary to security and correctness.
We are not looking for subjective style preferences.
What we expect from you
We want a written independent audit report.
Please classify findings as:
CRITICAL
Immediate blocker for production.
HIGH
Serious issue that should be fixed before production.
MEDIUM
Important issue but not necessarily a release blocker.
LOW
Minor issue / hardening recommendation.
INFORMATIONAL
Observation with no immediate security impact.
For every finding please provide:
Title
Severity
Affected component/file
Description
Why it matters
Reproduction/example where possible
Potential impact
Recommended remediation
Whether you consider it a production blocker
Important rules
This is an audit, not a development task.
Please do not modify the repository unless explicitly authorized.
Do not:
refactor code
change dependencies
change database structure
change configuration
fix bugs directly
deploy anything
modify production/staging data
If you identify a vulnerability, document it instead.
Independent review
We specifically want an independent second opinion.
We have already performed internal testing, but we will not provide our internal findings upfront because we want to avoid biasing the review.
You should approach the codebase as if you are seeing it for the first time.
Deliverables
Required:
1. Written technical/security audit report
2. List of findings sorted by severity
3. Production-release assessment
At the end, please provide a simple conclusion such as:
No Critical/High issues identified that should block production release.
or
Production release should be blocked until the following issues are resolved: ...
We are not asking you to make the business decision for us. We want your technical assessment.
Candidate requirements
Required:
strong PHP experience
strong Laravel experience
experience reviewing production applications
understanding of OWASP/web security
authentication/authorization experience
database experience
SaaS/multi-tenant experience preferred
ability to produce a professional written audit
Strongly preferred:
Laravel 10/11/12 experience
experience with SaaS applications
experience with multi-tenancy
security auditing
queue/background job systems
Linux deployment environments
Please include in your proposal
How many years of Laravel/PHP experience do you have?
Have you performed independent Laravel security/code audits before?
Give 1–3 examples of similar projects.
What security areas would you inspect first?
Have you worked with multi-tenant SaaS applications?
Have you reviewed authentication/2FA implementations?
What would your expected turnaround time be?
Your fixed price or estimated hours.
Please do not send a generic “I can do this” proposal.
We are specifically looking for someone who can demonstrate that they understand what an independent Laravel SaaS security review actually involves.
This is not a development project.
We do not want someone to modify, refactor or “improve” the codebase during the audit.
We want an experienced external engineer to independently inspect the code and tell us:
What is solid, what is risky, what is broken, and what should be fixed before production?
The goal is an honest third-party assessment.
About the application
We are developing OBRIVO, a Slovenian SaaS/business management platform for companies working in the construction/plastering industry.
The application contains both:
a tenant/customer application
a separate Platform Admin console
The current release candidate is:
OBRIVO 1.1.7
Technology stack includes:
PHP 8.x
Laravel 12
relational database
Laravel queues / database queue
systemd workers
server-side rendered web application / Blade
JavaScript frontend components
authentication
2FA / OTP
role-based authorization
multi-tenant architecture
PDF generation
file uploads/downloads
notifications
background jobs
database migrations
automated tests
release/deployment system
atomic release switching
health checks
signed release packages
The application is already running on a controlled staging environment and has gone through internal functional and E2E testing.
We now want an independent technical review, preferably by someone who has not been involved in the project.
Scope of the review
Please independently review the codebase, with particular attention to the following areas.
1. Authentication
Review:
login flow
password handling
session handling
session regeneration
logout
authentication middleware
remember-me functionality if applicable
password reset
authentication edge cases
brute-force protection
rate limiting
account enumeration risks
2. Two-Factor Authentication
Review:
OTP implementation
OTP verification
session state during 2FA
bypass possibilities
recovery/fallback mechanisms
authorization before and after 2FA
session fixation risks
ability to access protected areas before completing 2FA
Pay particular attention to the Platform Admin authentication flow.
3. Authorization / Access Control
This is one of the most important parts of the audit.
Review whether users can access data or actions outside their permissions.
Check for:
IDOR
insecure direct object references
missing authorization checks
tenant isolation problems
role escalation
privilege escalation
Platform Admin → tenant boundaries
tenant → Platform Admin boundaries
route middleware
controller authorization
policy/gate implementation
API/action-level authorization
We are particularly interested in whether a normal tenant user could ever access another tenant's data or Platform Admin functionality.
4. Multi-Tenancy
Review the architecture responsible for tenant isolation.
Look for:
missing tenant filters
unsafe queries
model scopes
authorization gaps
background jobs executing in the wrong tenant context
queued jobs without sufficient tenant context
accidental cross-tenant data exposure
tenant ID manipulation
indirect access through related models
Please attempt to identify realistic attack paths rather than only checking whether the code “looks correct”.
5. Web Application Security
Review for common vulnerabilities including:
XSS
CSRF
SQL injection
command injection
SSRF
path traversal
insecure redirects
mass assignment
unsafe deserialization
unsafe file handling
authorization bypass
information disclosure
sensitive data exposure
Use OWASP-style thinking where appropriate.
6. File Uploads / Downloads
Review:
uploaded file validation
MIME validation
extension validation
storage location
filename handling
path traversal
authorization when downloading files
ability to access another user's/tenant's files
dangerous file types
direct storage exposure
PDF/document handling
7. Database / Eloquent
Review:
Eloquent queries
raw SQL
mass assignment
relationships
scopes
migrations
indexes where relevant
transaction handling
race conditions
data integrity
tenant filtering
8. Queue / Background Jobs
Review:
queue configuration
job authorization/context
retries
failed jobs
timeout handling
duplicate execution
race conditions
idempotency
worker configuration
sensitive operations performed asynchronously
The application uses a database-backed queue and a systemd worker.
9. Release / Deployment System
The application has a custom release/deployment mechanism.
Please review the relevant deployment code for security and reliability issues, including:
release package validation
SHA-256 verification
release signatures
archive extraction
path traversal
permissions
ownership
atomic current switching
migration ordering
health checks
rollback behavior
concurrent deployment protection
lock handling
environment handling
production-path protection
We do not expect you to redesign the deployment system.
We want to know whether there are serious security or reliability flaws that should prevent production release.
10. Secrets / Configuration
Review:
.env usage
secrets exposure
logging
exception handling
debug mode
sensitive configuration
credentials accidentally committed to Git
application keys
API keys
production error disclosure
11. Dependencies
Review:
Composer dependencies
known vulnerable dependencies
dependency configuration
whether development packages could unintentionally be exposed in production
Please distinguish between:
actual exploitable vulnerabilities
theoretical risks
outdated but non-critical packages
12. Code Quality / Maintainability
We are also interested in:
dangerous patterns
duplicated security-sensitive logic
architectural problems
fragile code
error handling
test coverage gaps
areas likely to cause production incidents
This is secondary to security and correctness.
We are not looking for subjective style preferences.
What we expect from you
We want a written independent audit report.
Please classify findings as:
CRITICAL
Immediate blocker for production.
HIGH
Serious issue that should be fixed before production.
MEDIUM
Important issue but not necessarily a release blocker.
LOW
Minor issue / hardening recommendation.
INFORMATIONAL
Observation with no immediate security impact.
For every finding please provide:
Title
Severity
Affected component/file
Description
Why it matters
Reproduction/example where possible
Potential impact
Recommended remediation
Whether you consider it a production blocker
Important rules
This is an audit, not a development task.
Please do not modify the repository unless explicitly authorized.
Do not:
refactor code
change dependencies
change database structure
change configuration
fix bugs directly
deploy anything
modify production/staging data
If you identify a vulnerability, document it instead.
Independent review
We specifically want an independent second opinion.
We have already performed internal testing, but we will not provide our internal findings upfront because we want to avoid biasing the review.
You should approach the codebase as if you are seeing it for the first time.
Deliverables
Required:
1. Written technical/security audit report
2. List of findings sorted by severity
3. Production-release assessment
At the end, please provide a simple conclusion such as:
No Critical/High issues identified that should block production release.
or
Production release should be blocked until the following issues are resolved: ...
We are not asking you to make the business decision for us. We want your technical assessment.
Candidate requirements
Required:
strong PHP experience
strong Laravel experience
experience reviewing production applications
understanding of OWASP/web security
authentication/authorization experience
database experience
SaaS/multi-tenant experience preferred
ability to produce a professional written audit
Strongly preferred:
Laravel 10/11/12 experience
experience with SaaS applications
experience with multi-tenancy
security auditing
queue/background job systems
Linux deployment environments
Please include in your proposal
How many years of Laravel/PHP experience do you have?
Have you performed independent Laravel security/code audits before?
Give 1–3 examples of similar projects.
What security areas would you inspect first?
Have you worked with multi-tenant SaaS applications?
Have you reviewed authentication/2FA implementations?
What would your expected turnaround time be?
Your fixed price or estimated hours.
Please do not send a generic “I can do this” proposal.
We are specifically looking for someone who can demonstrate that they understand what an independent Laravel SaaS security review actually involves.
Apply on Freelancer →
Project sourced from Freelancer.com. Applications happen directly on the original platform — we never collect your data.