Perform 5-Day Comprehensive Security Review

Security Audit – Website & iOS/Android Apps We are looking for a developer/security specialist to perform a 5-day security review and manual testing of our website, backend and iOS/Android apps. The work includes: * Review and test Stripe integration, API keys, webhooks, payments, refunds, chargebacks, MobilePay and Apple Pay. * Review GDPR/security of personal data, access control, encryption, storage and deletion. * Manual review based on OWASP Top 10, including SQL Injection, XSS, CSRF, authentication, authorization and exposed API endpoints. * Test iOS and Android apps, including installation, login, backend communication, payments and data. * Review server/app logs, monitoring, PHP and other system versions. * Identify and report security risks and provide recommendations. Important requirements: * All sensitive credentials must be reviewed and, where required, changed/rotated and secured, including API keys, secret keys, webhook secrets, passwords and database credentials. * On Day 1, the freelancer must identify and inform us of all credentials/services that he cannot access and that we need to change or provide access to ourselves. * Access will initially be provided to FTP via SSH, control panel and Stripe. If additional access is required, the freelancer must request it from us. * Everything done must be documented, including tests performed, changes made, credentials/keys rotated, issues found, files delivered and configurations reviewed. * No hidden accounts, backdoors or unauthorized access may be created or left behind. * A final written security report must be delivered. * 5 working days total, including any delays. * Fixed price: $175 USD, paid through Freelancer.com in 2 milestones. * 2 weeks of free support after final delivery and final milestone payment. * All files, credentials, source code and information are strictly confidential and may not be shared with anyone. * All access and copies of files must be removed when the cooperation e