Java Full-Stack Security Audit

I have a full-stack Java codebase that I need set up, walked through, and examined from top to bottom. My first priority is uncovering any security vulnerabilities or hidden backdoors, so you will need to comb through the entire stack—server-side, client-side, build scripts, and deployment configs—looking for risky patterns, outdated dependencies, or suspicious commits.

Once the security sweep is complete, I also want your eye on execution speed. Any hotspots that slow response times, blocking calls, or inefficient algorithms should be flagged with clear, actionable fixes. You are welcome to profile locally or spin up a test environment; I’ll provide repo access and a clean VM image so you can reproduce the build.

Deliverables
• Written audit report that lists every discovered vulnerability, its severity, and recommended remediation steps
• Performance brief highlighting the slowest code paths with proposed optimisations
• Clean pull request (or patch set) containing any straightforward fixes you can make during the review
• Final validation showing the project builds and runs without new warnings or regressions

I expect industry-standard tools to be part of your workflow—SpotBugs, OWASP dependency-check, JUnit for safety nets, plus whichever profilers you trust for execution speed (VisualVM, YourKit, etc.). If you need additional access or scripted tests, just let me know; quick turnaround is appreciated, but thoroughness matters more.