Security Review for new mobile Member App/API

We need an independent security review of a new member app (React Native / Expo) and its PHP JSON API. This is not a redesign or a feature build.

The previous generation of this product had a serious incident (personal data exposed). That stack is retired. We want a review of the new app and API before a wider release.

This is a small member app for people who already belong to a venue/club. It is not a marketplace, social network, or payments app.

What it does today (this is the whole product):
- Sign in, create account, verify email, reset password (reset is a simple web page)
- 8 languages
- Accept terms when they change
- Home: greeting, shortcuts; optional club “home” when a club is selected
- Clubs: list of linked clubs, pending/unavailable states, add a club with a code (connects an existing membership; staff finish the link)
- Profile: name, photo if the club has one, credit, member type, membership status, QR to show on site
- Log out

What it does not do:
- No chat, feed, map, camera KYC, in-app payments, or admin tools
- No browsing or “joining” random clubs from the app
- Staff-side club software is a separate system and is out of scope unless we say otherwise

Size (for quoting):
- One React Native / Expo app (iOS + Android, same code)
- A small PHP JSON API: on the order of ~12 endpoints (login, session, register, password reset, profile, add-club, languages, etc.)
- A few static web pages (verify email, reset password)

We expect a short, time-boxed review (days, not weeks), not a full enterprise pentest, unless you explain why more time is needed.

What we will provide (after hire, not in this post):
- TestFlight / Android preview builds
- A throwaway member account
- Read-only or time-limited access to the API source and app source under NDA
- A written scope and rules of engagement

In scope:
- iOS and Android client (same codebase)
- Public HTTPS API used by the app (login, session, registration, password reset, profile, club linking)
- Auth: passwords, sessions, email verification, password reset
- Access control: one member must not read or change another member’s data or another club’s data
- Secrets in the client, local storage, logging
- Transport (HTTPS), session handling, rate limiting, common API issues (auth bypass, IDOR, injection, mass assignment)
- High-level review of server exposure of private folders / config (no full infra pentest unless agreed)

Out of scope (unless we agree in writing):
- Denial of service / load testing
- Other products or domains we have not named
- Phishing our staff or testers
- Accessing real customer or club production data
- Social engineering
- Publishing findings before we have had time to fix them

What we are not asking for:
- A rewrite of the app
- “Unpack the APK and send us exploits”
- A generic automated scan dump with no explanation

Deliverables:
- A written report: findings, severity (e.g. Critical / High / Medium / Low / Info), affected endpoint or component, impact, and a clear fix recommendation.
- A short call to walk through the report.
- Re-test of issues we mark as fixed (within an agreed window).

How you should work:
- Time-boxed (please bid a number of days, not “until we find something”).
- Use only the test account and systems we name.
- Stop and tell us immediately if you find live personal data you should not have.
- No public write-up or CVE without our written OK.

Please include in your bid:
- 2–3 similar mobile + API reviews (no need to name clients if under NDA)
- Whether you prefer source-assisted or black-box, and why
- Your report sample (redacted is fine)
- Fixed price and number of days
- Confirmation you will sign an NDA
- We will not share production admin credentials or the live database with freelancers. Testers use a dedicated account.