Perform 5-Day Comprehensive Security Review

Security Audit – Website & iOS/Android Apps

We are looking for a developer/security specialist to perform a 5-day security review and manual testing of our website, backend and iOS/Android apps.

The work includes:

* Review and test Stripe integration, API keys, webhooks, payments, refunds, chargebacks, MobilePay and Apple Pay.
* Review GDPR/security of personal data, access control, encryption, storage and deletion.
* Manual review based on OWASP Top 10, including SQL Injection, XSS, CSRF, authentication, authorization and exposed API endpoints.
* Test iOS and Android apps, including installation, login, backend communication, payments and data.
* Review server/app logs, monitoring, PHP and other system versions.
* Identify and report security risks and provide recommendations.

Important requirements:

* All sensitive credentials must be reviewed and, where required, changed/rotated and secured, including API keys, secret keys, webhook secrets, passwords and database credentials.
* On Day 1, the freelancer must identify and inform us of all credentials/services that he cannot access and that we need to change or provide access to ourselves.
* Access will initially be provided to FTP via SSH, control panel and Stripe. If additional access is required, the freelancer must request it from us.
* Everything done must be documented, including tests performed, changes made, credentials/keys rotated, issues found, files delivered and configurations reviewed.
* No hidden accounts, backdoors or unauthorized access may be created or left behind.
* A final written security report must be delivered.
* 5 working days total, including any delays.
* Fixed price: $175 USD, paid through Freelancer.com in 2 milestones.
* 2 weeks of free support after final delivery and final milestone payment.
* All files, credentials, source code and information are strictly confidential and may not be shared with anyone.
* All access and copies of files must be removed when the cooperation e