OAuth/OIDC, LTI 1.3 & PII-Intake Security Review (1–2 days)

We need an independent application-security reviewer (OAuth 2.0 / OIDC / LTI 1.3) to review and sign off on the identity layer of a new platform before production. A WordPress install acts as an OIDC Identity Provider (SSO into Moodle) and an LTI 1.3 platform, both signed by one shared RSA keypair (~1,200 lines, 3 PHP files). Also in scope: a new public "Ask-a-Scholar" intake endpoint that stores an asker's name and email — review its input validation, bot/abuse protection (Cloudflare Turnstile), rate-limiting, length caps, and PII handling (retention plus privacy export/erase). Our internal static review and 9-attack battery are done; you verify independently and go deeper against the OAuth 2.0 Security BCP (RFC 9700). A local replica is provided; no production access required. Deliverable: a written report with findings by severity and a pass / pass-with-conditions / fail verdict.