Refine, Secure & Launch Express Kitchen App

Project Description: Complete, Secure, and Launch My Express Kitchen Web Application

I have an existing cloud-kitchen food ordering web application, Express Kitchen, built using React, TypeScript, Node.js, Express.js, Firebase/Firestore, and Google Cloud. The application is already developed, but several functionalities require debugging, security improvements, end-to-end testing, and production deployment.

Website: https://Express-Kitchen.ai.studio

I am looking for an experienced Full-Stack Developer who can take ownership of the existing application, fix the outstanding issues, preserve all working features, and make the website fully functional, secure, and production-ready.

1. Complete Application Audit and Bug Fixes

- Review the existing source code and application architecture.
- Identify and resolve broken functionality, runtime errors, API failures, and database issues.
- Restore previously working features without unnecessary UI redesign or rebuilding the application from scratch.
- Verify that the frontend, backend, APIs, and database work together correctly.

2. Customer Ordering and Admin Functionality

- Ensure customers can browse menus, select food items, customize orders, apply coupons, and complete checkout.
- Verify cart management, pricing calculations, taxes, delivery charges, discounts, and order totals.
- Ensure orders are saved correctly and remain available after page refreshes, server restarts, and deployments.
- Verify that administrators can manage menu items, prices, coupons, orders, customers, inventory, and order statuses.
- Ensure all existing business functions work as expected.

3. Secure Login, OTP, and Password Reset

- Fix customer and administrator login, logout, session management, and authentication.
- Integrate and validate MSG91 OTP verification for the existing customer login flow.
- Fix the administrator forgot-password workflow using WhatsApp OTP through the configured MSG91 messaging service, including secure password reset and confirmation.
- Resolve infinite loading screens, failed OTP delivery, incorrect verification, and password reset errors.
- Implement appropriate OTP expiration, retry limits, rate limiting, and secure password storage.

4. Razorpay Payment Integration

- Verify the complete payment lifecycle, including order creation, payment success, payment failure, cancellation, and refunds where supported.
- Implement secure server-side payment verification and Razorpay webhook signature validation.
- Prevent duplicate orders, duplicate payment processing, and fraudulent payment-success responses.
- Ensure order and payment statuses remain consistent, including when callbacks are delayed or the customer closes the browser.

5. Security and Data Protection

- Identify and fix critical vulnerabilities in authentication, authorization, APIs, and database access.
- Secure administrator routes and ensure customers cannot access other customers' personal information or orders.
- Configure appropriate Firestore security rules and backend access controls.
- Remove authentication bypasses, test-mode payment fallbacks, exposed secrets, and insecure production configurations.
- Protect customer information, passwords, OTPs, payment data, and administrative records.
- Implement input validation, rate limiting, secure sessions, and appropriate security headers.

6. Firebase and Google Cloud Production Deployment

- Review the current Firebase and Google Cloud configuration and select the appropriate production hosting architecture.
- Ensure the application uses reliable persistent storage rather than local file-based storage that may fail in a multi-instance cloud environment.
- Configure production environment variables, secrets, domain settings, HTTPS, and CORS correctly.
- Verify database backups, recovery procedures, application health checks, error logging, and monitoring.
- Deploy the application without unnecessary downtime and provide a rollback plan if issues occur.

7. MSG91 and Customer Notifications

- Verify the configured OTP and WhatsApp messaging integrations.
- Ensure relevant customer notifications are triggered at the correct stages of the order lifecycle, where these features already exist.
- Handle API failures, retries, duplicate notifications, and delivery errors appropriately.
- Ensure messaging credentials and customer information are protected.

8. Complete End-to-End Testing

Perform end-to-end testing of all existing functionality, including:

- Customer registration, login, OTP verification, and password reset.
- Menu browsing, cart management, coupons, checkout, and order placement.
- Successful, failed, and cancelled payments.
- Duplicate payment callbacks and order consistency.
- Administrator login and all existing administrative functions.
- Order updates, notifications, and database persistence.
- Unauthorized access, customer-data isolation, and security controls.
- Mobile responsiveness and basic performance checks.
- Production deployment, application health, error handling, and recovery procedures.

Provide a test report listing the test scenarios, results, outstanding issues, and any limitations.

9. Performance, Handover, and Support

- Optimize existing code and API performance where necessary.
- Fix major console errors, backend errors, and avoidable loading delays.
- Maintain the existing design and business workflows unless a change is necessary to fix a defect.
- Provide source-code updates, deployment instructions, configuration documentation, and a list of completed fixes.
- Provide post-launch support to resolve defects related to the agreed scope.

Expected Deliverables

The project will be considered complete when the existing application has been audited, the agreed critical defects have been fixed, security controls have been validated, the existing functionality has passed regression testing, and the application is successfully deployed and verified in production.

The developer must not simply make the website accessible. The objective is to make it secure, reliable, fully functional, and ready to accept real customer orders and payments.

Project Budget and Timeline

- Budget: ₹25,000–₹40,000, depending on the audit findings and agreed scope.
- Target timeline: 3–7 days, subject to the initial audit and complexity of the fixes.
- Engagement: Fixed-price project with milestone-based payments.
- Important: This is an existing application that needs completion and remediation, not a complete redesign or rebuild.

Please apply only if you have hands-on experience debugging, securing, testing, and deploying production web applications using React, Node.js, Firebase, and Google Cloud. In your proposal, explain your approach, earliest availability, estimated timeline, relevant experience, and fixed-price quotation.