Security assessment & penetration test — fintech web app (3 portals)

Remote · Fixed price: $150 USD · 1 week · NDA required About the project:- We're building Estra Finance — an AI-enabled mortgage brokerage platform in the Philippines. The platform connects real estate developers, borrowers, and lender banks across three portals: a Borrower Portal, a Developer Partner Portal, and an Admin Portal. We're approaching a wider launch and need a thorough security assessment before going live. The platform handles sensitive KYC documents, financial records, and loan applications — security is a top priority. Scope of work :- Testing is against a designated staging environment only. No destructive testing without written approval. 1, Web application testing (OWASP Top 10) Auth & session management, privilege escalation, injection, XSS/CSRF, IDOR, business logic flaws 2, API security testing Full REST endpoint enumeration, JWT manipulation, RBAC enforcement, rate limiting, mass assignment 3, File upload & storage security KYC upload validation, Supabase Storage bucket access controls, path traversal 4, Infrastructure & configuration review Fly.io deployment, SSL/TLS, HTTP security headers, Supabase RLS policies, secrets exposure 5, AI & integration attack surfaces OpenAI key exposure, prompt injection, Bull/Redis queue security, OAuth callback security Skills required Penetration Testing - OWASP Top 10 - Web App Security - API Security - XSS / CSRF - SQL Injection - Privilege Escalation - JWT Security - RBAC Testing Who we're looking for :- Expert-level pentester with proven experience testing fintech or data-sensitive web applications. Must have hands-on knowledge of Supabase RLS, JWT-based auth, and NestJS APIs — and deliver clean, professional reports with CVSS scores and actionable fixes. Certifications (OSCP, eWPT, CEH) preferred but strong work samples carry more weight.