Urgent Same-Day Payment Security Audit of Live Codebase

We need an experienced application security engineer or senior full-stack developer to perform an urgent audit of our current production codebase, focused primarily on our payment system. The main goal is to confirm that payments are being processed correctly and that no funds, transactions, or customer payment information are being redirected, intercepted, or siphoned. You must independently retrieve the active deployed codebase directly from our OrangeWebsite VPS. We do not want the audit based only on a ZIP file provided by the previous developer. The audit should include: * Payment gateway integration and complete transaction flow * Merchant account IDs, API keys, endpoints, and payment destinations * Webhooks, callbacks, redirects, and checkout logic * Unauthorized payout or payment-routing changes * Hidden scripts, backdoors, malicious code, or remote access * Suspicious dependencies, scheduled tasks, and server-side processes * Differences between the live production code and the source repository, if available * Admin access, environment variables, deployment settings, and database activity related to payments * Evidence of code tampering or unauthorized changes Deliverables: * Written summary of all findings * Clear confirmation of where payments are currently being sent * List of vulnerabilities or suspicious code, with file locations and supporting evidence * Immediate notification if anything critical is discovered * Recommended steps to secure the payment system * A copy or snapshot of the exact production code reviewed This is initially a read-only audit. Do not modify production code, rotate credentials, or interrupt the live website without our approval. The selected auditor will be required to sign an NDA before receiving any server credentials, source code, or confidential business information. If you are unwilling to sign an NDA, please do not apply. You must be available to begin immediately and complete the initial audit today. When applying, include: 1. Your experience with payment-security and source-code audits 2. The payment gateways and frameworks you have worked with 3. How you will securely retrieve and verify the active code from the VPS 4. Confirmation that you can sign an NDA before receiving access 5. Confirmation that you can begin and complete the audit today 6. Your fixed, all-inclusive price for completing the audit Proposals that do not include a specific price will not be considered. Please start your proposal with “PAYMENT AUDIT” so we know you read the full post. This may lead to additional security and development work.