Security Review / Penetration Test — E-Signature Signing Workflow (Web App)

We're looking for an experienced security professional to conduct a scoped penetration test of the signing workflow within our e-signature SaaS platform (Asignu, built with a web app + API backend). Scope: please read carefully, this is intentionally narrow: We are NOT asking for a full application pentest. The scope is limited to the electronic signature signing process, specifically: - Document integrity verification (SHA-256 file hashing — before/after signing) - Authentication methods used during signing (email OTP, SMS OTP, 2FA) — can these be bypassed or spoofed? - Sole-control mechanisms — can someone sign on behalf of another user without their credentials? - Tamper-detection — can a signed document be modified post-signature without detection? - PAdES digital signature / timestamp validation — is this implementation sound against tampering or replay attacks? - API endpoints directly involved in the signing flow (not the full API surface) Deliverable: A written report (PDF or Word) covering: - Methodology used - Findings, categorized by severity (critical/high/medium/low) - Specific recommendations for remediation - A summary statement on whether the signing workflow's integrity/authentication mechanisms hold up under testing Requirements: - Proven experience with web application and API penetration testing - OSCP, OSWE, or CEH certification (please include in your proposal) - Portfolio of prior pentest reports (anonymized/redacted is fine) please share an example - Comfortable working with cryptographic hashing and digital signature validation (PAdES/PKI a plus) - Fluent English for the written report Timeline: 1–2 weeks from kickoff to final report To apply, please include: - Relevant certifications - A redacted example of a past pentest report - Your proposed timeline and fixed price for this scope Testing will be conducted against a staging environment with synthetic test data — not live production data.