Silent Key Security & QA Audit

## Project Overview

I am the developer of Silent Key (https://silent-key.in), a web-based messaging application.

I am looking for an experienced Website QA Engineer / Application Security Researcher to conduct a comprehensive review of my website and identify bugs, critical issues, security weaknesses and functional problems.

The objective is to identify problems before they affect users and improve the overall reliability, security and performance of the platform.

## Areas to Investigate

### 1. Security Audit
- Authentication and login vulnerabilities.
- Firebase Authentication configuration.
- Firestore Security Rules and access-control issues.
- Unauthorized data access risks.
- Sensitive information exposure.
- Session management problems.
- Input validation and injection risks.
- API and backend configuration weaknesses.
- Security headers and deployment configuration.

### 2. Functional Bug Detection
- Registration and login failures.
- Messaging and conversation synchronization issues.
- Message sending, editing and deletion problems.
- Group chat functionality.
- User profile and account management bugs.
- Notification issues.
- Date and timestamp errors.
- Mobile responsiveness problems.

### 3. Performance and Reliability
- Slow-loading pages.
- JavaScript errors and failed requests.
- Browser compatibility.
- Memory or resource issues.
- Unnecessary network requests.
- Application stability.

## Required Deliverables

I expect a detailed technical report containing:

1. All identified bugs and vulnerabilities.
2. Severity classification: Critical, High, Medium and Low.
3. Steps to reproduce each confirmed issue.
4. Evidence such as relevant screenshots or sanitized logs.
5. Explanation of the potential impact.
6. Recommended fixes.
7. A summary of the overall security and reliability assessment.

Please clearly distinguish confirmed vulnerabilities from suspected issues.

## Testing Restrictions

- Testing is authorized only for Silent Key and explicitly approved project infrastructure.
- Use test accounts and test data wherever possible.
- No destructive testing, denial-of-service attacks, brute-force attempts or unauthorized data access.
- Do not access, download or disclose real users' private conversations or personal information.
- Do not modify or delete production data.
- Report critical discoveries responsibly and promptly.

## Required Skills

- Web application security testing.
- Firebase Authentication.
- Firebase Firestore Security Rules.
- JavaScript debugging.
- Frontend application testing.
- API security assessment.
- OWASP web application security knowledge.
- Performance and browser compatibility testing.

## When Applying, Please Include

- Your previous website security auditing experience.
- Examples of similar projects.
- Your proposed testing methodology.
- Estimated completion time.
- Your fixed project price.

I am looking for a thorough, evidence-based audit rather