Full-Stack Developer: Security Hardening + Cloudflare Pages Launch for React Site

B2B travel microsite launching 4 September 2026. Built in Lovable (React, GitHub-synced), content-complete and functional. We need an experienced full-stack developer to take it to production: audit the existing build, set up Cloudflare deployment, harden the security-critical parts, and own the launch. This is hardening and deployment, not building. The site works today. Your job is to make it secure, monitored, documented, and live. The hours below are our estimates. If any line looks unrealistic, push back in your proposal. We would rather adjust the plan now than mid-engagement. The launch date is fixed; the hours are not. THE PROJECT - 7 regions, 18 itineraries, enquiry form as the primary conversion point - Lovable build, GitHub repository under our control, target hosting Cloudflare Pages - No database, no user accounts, no CMS. Static content plus one form - All accounts (GitHub, Cloudflare, domain, Lovable) remain in our name; you work inside them HOW WE WORK: STAGING FIRST Deployment is the framework everything else is tested through, not a final step. Your first task after the audit is establishing the pipeline: repo connected to Cloudflare Pages, staging environment live, rollback path confirmed. From then on, every change (form, headers, patches) deploys to staging, gets tested there, and is promoted to production only once proven. By launch day, going live is a routine promotion of something already tested many times, not a first attempt. SCOPE AND ESTIMATES (open to your revision) Week 1, from start to 28 August: - Kick-off, codebase audit and plan, 2h: repo, hosting, DNS, form implementation, dependencies, external services. Short written note on what is clean and what is risky. - Staging and deploy pipeline, 3h: Cloudflare Pages setup, DNS and SSL review, staging and production environments, GitHub deploys, rollback path, secrets. - Enquiry form, 4h: server-side validation, spam protection (honeypot, rate limiting), reliable delivery, failure handling, tested on staging. A failed email must never silently lose a lead. - Security begins, 2h: dependency audit and safe patching. Week 1 milestone: staging live with a working, hardened form by 28 August. Week 2, 28 August to 3 September: - Security completion, 4h: security headers, CSP tested against real third parties on staging, HSTS, WAF and caching configuration. - Monitoring, 2h: uptime checks, application error tracking, enquiry form failure alerts. - Documentation, 3h: architecture overview, deployment guide, environment variables, recovery and rollback steps. Written to be readable by a future maintainer picking the site up cold. - Cutover and QA, 2h: production deploy, mobile and desktop smoke tests, real form submission, CSP verification, monitoring confirmation, rollback check. Total: 22 hours estimated. Hours beyond the estimate require our written approval before they are worked. SIGN-OFFS THAT REMAIN WITH US DNS changes, the CSP allow-list, risky dependency updates, enquiry delivery destination, secrets, and the final cutover. You recommend, we approve. MAINTENANCE AFTER LAUNCH We intend to place this site on a monthly maintenance retainer, currently being confirmed with the end client. Likely shape: approximately 4 hours per month covering monitoring, dependency updates, and small fixes, unused hours rolling over one month. The person who launches the site is the natural first choice. If ongoing work interests you, say so; it factors into our decision. TIMELINE - Start: on hiring, ideally by 22 to 24 August - Audit note delivered within the first two days - Staging live with working form: 28 August - Security and monitoring verified on staging: 1 September - Cutover: 2 to 3 September - Launch: 4 September (fixed, client commitment) - Async communication during Singapore business hours (SGT), response within one business day - Brief written progress note at the end of each week BUDGET AND TERMS - Hourly against the agreed estimate; state your rate in your proposal - Two invoices: at the Week 1 milestone, and on completion after launch - Payment within 10 calendar days of invoice - 30-day warranty on delivered work following go-live TO APPLY Keep it short. Include: 1. One comparable site you deployed and hardened on Cloudflare Pages, Netlify, or Vercel, and what you personally handled 2. Your CSP approach on a site with third-party embeds, in 3 to 4 sentences 3. Which line in our estimate you would change, and to what. This is the answer we read most carefully 4. Whether monthly maintenance interests you 5. Your rate and availability, 22 August to 4 September Applications opening with generic boilerplate will not be read.