Xss jobs

...Hume apne Android application ka authorized security audit karwana hai. Hume ek experienced Android security tester chahiye jo APK, APIs aur backend communication ko test karke security vulnerabilities identify kare aur unke practical fixes bataye. Work Scope: - APK static aur dynamic security analysis - Authentication aur session security testing - API security testing - SQL Injection, IDOR, XSS aur access-control testing - SSL/TLS aur certificate pinning review - Sensitive data storage aur data leakage check - APK decompilation, code obfuscation aur tampering protection review - Root detection, emulator detection aur anti-debugging review - Hardcoded API keys, URLs, credentials aur secrets check - Firebase, WebView, permissions aur exported components review - Business-logic ...

...uploads for products and blog posts. • Implement a validated contact form that sends messages to my email and stores submissions in the database. Key expectations • Clean, well-commented code organized by MVC best practices. • Fast load times, on-page SEO fundamentals (semantic markup, meta tags, friendly URLs), and accessibility considerations. • Protection against common attacks (CSRF, XSS, SQL injection) and sensible rate-limiting on auth routes. • Clear setup documentation so I can deploy the project on a typical LAMP/LEMP server. When handing over the project, please include: 1. The complete Laravel project folder with all source files. 2. SQL export of the schema and seed data. 3. A short README detailing installation, environment ...

...change, decision issued. • Standard audit logs and at-a-glance dashboards with drill-downs; I’ll share exact fields and KPIs after award. Security & Access We are keeping authentication straightforward—no multi-factor layer is required—yet the usual ASP.NET Identity best practices still apply (hashed passwords, password reset, lockout policies). Please harden every endpoint against injection, XSS, and CSRF. All files, especially uploads, must be virus-scanned and stored outside the web root. Development & Handover Code must be clean, well-commented, and follow SOLID principles. On completion I expect: 1. Full Visual Studio solution with source, SQL scripts for schema and seed data, and any third-party libraries clearly documented. 2. Depl...

...Redis * MongoDB (optional for analytics) ### Authentication * JWT Authentication * OAuth (Google, GitHub) * Two-Factor Authentication (2FA) ### Cloud & Deployment * Docker * Nginx * AWS / Azure / DigitalOcean * CI/CD Pipeline using GitHub Actions --- # Security Requirements * HTTPS encryption * Role-based access control * Secure authentication * Password hashing * SQL injection protection * XSS protection * CSRF protection * API rate limiting * Automated backups * Activity logging --- # Performance Requirements * Fast page loading * Server-side rendering (SSR) * Image optimization * CDN support * Database indexing * Caching with Redis * Lazy loading * API optimization --- # Future Enhancements * AI-powered content recommendations * AI writing assistant * Email ma...

...price, and available liquidity pools update in near-real-time without causing API rate-limiting or lag. 4. Engineering & Deployment Guardrails Critical Directive: Sanitization & Security All code destined for the PROMPTLORD deployment pipeline must be completely sanitized before handover. Input Sanitization: Validate and escape all user-facing strings and contract data arrays to completely eliminate XSS or injection vulnerabilities. Secrets Management: Absolutely zero API keys, private keys, or RPC URLs are to be hardcoded. Use strictly typed . templates. Error Handling: Ensure no raw stack traces or internal contract reverts are exposed directly to the DOM without user-friendly, accessible sanitization wrappers. 5. Acceptance Criteria for Handover To consider this miles...

...complete security audit of our application. - Identify vulnerabilities in the web application, APIs, database, and server. - Perform penetration testing and vulnerability assessment. - Review the application against the OWASP Top 10. - Analyze authentication, authorisation, session management, and input validation. - Review API security and identify potential attack vectors. - Assess SQL injection, XSS, CSRF, SSRF, IDOR, file upload, and other common vulnerabilities. -Review Linux server configuration and security hardening. - Assess cloud security configuration (if applicable). - Review source code for secure coding practices. - Investigate any suspicious activity or security incidents if discovered. - Provide a detailed report of findings, risk levels, proof of concept (where a...

...Plans: Monthly/yearly premium memberships for businesses, car dealerships, or real estate agencies. 4. Technical Quality & Performance Standards * Real-Time Data Sync: Bids and countdown timers must update instantly across all platforms using technologies like WebSockets. * Security: Robust data encryption, secure password hashing, and protection against common vulnerabilities (SQL Injection, XSS). * Localization: Complete and accurate RTL (Right-to-Left) support for Arabic, alongside LTR for English. 5. Required Deliverables from the Developer/Agency * Full Clean Source Code: Fully documented and structured code repository. * Deployment & Launch: Successful publishing of the apps on Google Play and Apple App Store, and deployment of the website/admin panel on a prod...

...admin console, and a wallet that handles deposits, withdrawals, and payment-gateway traffic. Primary focus is the payment gateway and wallet layer, yet I still want every public or privileged surface probed against the full OWASP Top 10 as well as common esports-specific attack patterns. That includes: authentication and authorization flows, admin privilege escalation, API abuse, IDOR, SQLi, XSS, insecure file uploads, exposed secrets, and verification of Supabase row-level security. Attempted manipulation of balances or tournament results is welcomed if it highlights a weakness. When the engagement ends I expect a full vulnerability report. It should rank findings by risk, reproduce each issue step-by-step, and supply clear remediation advice. Screenshots or PoC scripts are ...

...Detection - Smart Albums - AI Search - AI Tags - AI Recommendations - AI Highlights --- 16. Analytics - Total Visitors - Downloads - Gallery Views - Storage Used - Revenue - Active Users - AI Searches - Devices - Countries --- 17. Notification System - Email - SMS - WhatsApp - Push Notification - In-App Notification --- 18. Security - SSL - JWT Authentication - Rate Limiting - CSRF Protection - XSS Protection - SQL Injection Protection - Image Validation - Virus Scan - Secure Downloads --- 19. Mobile Responsive Perfect support for - Android - iPhone - Tablet - Desktop --- 20. Performance - Lazy Loading - CDN - Image Optimization - Fast Loading - Background Processing - Caching - Queue System --- Tech Stack (Preferred) Frontend - / React - Tailwind CSS - TypeS...

...services for web applications, APIs, and network environments. My testing follows the OWASP Web Security Testing Guide and industry best practices to identify security vulnerabilities before they can be exploited. Services include: * Web Application Penetration Testing * API Security Testing * Authentication & Authorization Testing * Business Logic Testing * OWASP Top 10 Assessment * SQL Injection, XSS, CSRF Testing * File Upload Security Testing * Security Headers & Misconfiguration Review * Sensitive Information Disclosure Assessment * Session Management Review Tools Used: Burp Suite Professional, Nmap, Nuclei, OWASP ZAP, ffuf, httpx, and manual testing techniques. Deliverables: * Executive Summary * Detailed Technical Report * CVSS Severity Ratings * Proof of Conc...

...in a database. Changes made through the administration dashboard should immediately be reflected on the public website. The database should be properly normalized and designed for future expansion. --- # Security Requirements The application should follow secure development practices, including: * Password hashing * Protection against SQL Injection * Protection against Cross-Site Scripting (XSS) * Protection against Cross-Site Request Forgery (CSRF) * Secure authentication * Input validation * Secure file uploads * Proper authorization checks --- # Design Expectations The website should have: * Modern UI/UX * Professional appearance * Clean typography * Consistent spacing * Responsive layout * Fast loading * Smooth user experience --- # Deliverables The selected free...

...injection, XSS, CSRF, file uploads, API security, and common web vulnerabilities Provide a detailed report with severity ratings, proof of concept, remediation guidance, and one retest after fixes Please include: Relevant experience Your certifications (Examples: OSCP, OSWE, eWPT or equivalent.) Sample redacted report Estimated duration and fixed-price quote What we are looking for - Your ideal skills and experience: - Strong web testing skills - Excellent attention to detail - Ability to work efficiently and meet strict deadlines - Thorough and complete effort - Knowledge of website testing and validation techniques Your VAPT report should include Authentication and session management Authorization and privilege escalation Business logic flaws SQL Injection Cross-Site Scrip...

...front end. The goal is a store that feels fast, looks polished on every screen size, and is easy for me to maintain through a clean admin panel. Scope of work • Set up a solid CodeIgniter MVC structure and design the MySQL schema. • Craft a lightweight, mobile-first UI: HTML5, CSS3 (Flexbox/Grid), vanilla JS or jQuery where useful. • Bake in security from the start—prepared statements, CSRF/XSS protection, password hashing, HTTPS readiness—following OWASP guidance. • Build the key e-commerce flows: product display, search/filtering, customer accounts and checkout. (I’m flexible on extras such as user reviews or advanced cart logic; we can refine during discovery.) • Create an intuitive admin dashboard for products, pages, media,...

...Management - Withdrawal Management - KYC Management - Reports - Analytics - Fraud Detection - System Logs 10. Analytics - Win Rate - Risk Score - Equity Curve - Performance Graph - Leaderboard - Daily Reports - Monthly Reports 11. Notification System - Email Notifications - SMS Notifications - Push Notifications - Announcement System 12. Security - SSL - Secure Login - SQL Injection Protection - XSS Protection - CSRF Protection - Encrypted Data - Audit Logs TECH STACK Frontend: - React.js or Backend: - Node.js (Express/NestJS) or Python (Django/FastAPI) Database: - PostgreSQL - Redis Hosting: - AWS or DigitalOcean Other: - REST API - WebSocket - Docker DELIVERABLES - Complete Source Code - Admin Panel - User Panel - Database - API Documentation - Deployment - Testing ...

Very short Coding Project. Need help creating a xss worm. Teacher's template included. Need help only from 4.7 to the end

...layout, professional icons, typography, accessibility, smooth navigation, consistent colors. 8. Functional Requirements Support all existing backend features, including authentication, profile management, streaming, subscriptions, payments, notifications, and settings. 9. Performance Optimize assets, lazy loading, caching, CDN-ready, Lighthouse target >90 where feasible. 10. Security CSRF, XSS protection, validation, HTTPS, secure session handling. 11. Deliverables Laravel Blade frontend source code, iOS/Android UI updates, documentation, installation, and deployment guides. 12. Acceptance Criteria Blade-only frontend, backend unchanged, API compatibility, responsive design, tested mobile apps, and documentation delivered. 13. Out of Scope Backend redevelopment, da...

Comprehensive Audit (Most Popular) Web Application Penetration Testing A professional web application security audit (black-box analysis) is required. - Identify vulnerabilities from the OWASP Top 10 list (SQLi, XSS, SSRF, etc.). - Check authorization logic, session management, and access rights. - Test API and file upload mechanisms. **Result:** A technical report with a detailed description of each vulnerability, screenshots (PoC), and clear recommendations for remediation. **Timeframe:** [3-5 days]. **Budget:** [from $500 to $2,500]. Option 2: Mobile Application Audit Mobile Application Security Audit (iOS/Android) A mobile application needs to be tested for vulnerabilities and data leaks. - Client-side security analysis (data storage, obfuscation). - Backend security check...

...health. Please perform a full vulnerability assessment, locate and remove every malicious script or file you discover, then harden the platform so the same exploit cannot reappear. The most business-critical areas are the payment gateway, customer database, and admin panel. I expect each of those surfaces to be stress-tested, patched, and monitored against common threat vectors (SQL injection, XSS, CSRF, file-upload exploits, brute-force logins, etc.). You are free to use industry-standard tools—from OWASP testing utilities to server-side malware scanners—so long as nothing disrupts live transactions. I can supply temporary admin credentials and schedule maintenance windows to minimise customer impact. Deliverables • Detailed security report outlining every ...

...Queue system Caching Background jobs --- # AI Integration Claude API Streaming Conversation memory Retry handling Automatic fallback Token counting Prompt optimization Context management Conversation summarization System prompts Temperature controls Model selection --- # Security JWT Refresh Tokens Encryption Rate limiting Captcha CSRF protection SQL Injection prevention XSS protection Audit logs Role permissions Secure API storage Environment variables Secret management --- # Frontend React TypeScript TailwindCSS Shadcn UI Framer Motion Responsive Dark Mode Light Mode Beautiful animations Professional dashboard Modern SaaS design --- # UX Cursor-like experience Instant responses Keyboard shortcuts Resizable panels Dockable lay...

...through code • Deployment instructions plus a brief hand-over document explaining key configuration points * It may be necessary to modify images or charts provided to create seamless integration * Only unique relevant and appropriate licensed stock images to be used. - some company specific images will be provided. Acceptance Criteria The site must pass a basic security audit (no obvious XSS/SQL-injection vectors), load in under 30 sections on a standard broadband connection, and display flawlessly in the latest versions of Chrome, Firefox and Safari. Budget Up to about $300 as this doesnt involve to much complexity Send a short outline of your proposed approach and any relevant live examples you have built in PHP, and we can move forward quickly. Generic response...

...operations - Distributed locking where appropriate No manual refresh should ever be required. --- Security Enterprise security standards must include: - RBAC (Role-Based Access Control) - ABAC support - MFA - JWT authentication - Refresh tokens - Session management - Device registration - Audit logging - End-to-end TLS encryption - Encrypted storage - API rate limiting - SQL injection protection - XSS protection - CSRF protection - Secure file uploads - Password policies - IP restrictions - Active session monitoring Comply with GDPR-ready security principles and industry best practices. --- User & Organization Management Support: - Multi-tenant architecture - Unlimited organizations - Departments - Sites - Plants - Facilities - Teams - Roles - Permissions - Approval...

...Backend and Admin Panel Admin panel must allow editing: Home About Services Solutions AI and Automation Industries Careers Legal pages SEO meta fields Contact information Contact form entries Media gallery Backend stack can be Node.js, Laravel, or Django. Database can be MySQL, PostgreSQL, or MongoDB. Security Requirements Secure authentication Password hashing Sanitized inputs XSS and SQL injection protection Basic audit logging --- 4. Content Writing Developer must write all website content manually. No AI tools allowed. Content required for: Home, About, Services, Solutions, Industries, AI section, Careers, Contact, Admin panel descriptions, and all legal pages. --- 5. Advanced SEO Setup Meta titles and descriptions Sitemap OG tags Schema mar...

...Scope The assessment must cover the full web stack—front-end, back-end, APIs and any server-side components tied to the apps. Automated scanning is fine as a first pass, yet I expect you to validate every finding manually and look beyond scanner results for business-logic or access-control issues. High-priority findings Please focus your efforts on: • SQL injection • Cross-site scripting (XSS) • Cross-site request forgery (CSRF) You are free to uncover and report additional issue types, but the three above are non-negotiable. Methodology & tools Follow OWASP Testing Guide principles. Tools such as Burp Suite, OWASP ZAP, sqlmap or custom scripts are welcome as long as they are used responsibly and within the agreed test window. Deliverabl...

I’m ready to move from concept to production on a web-based...responsive design are non-negotiable. Deliverables 1. Full source code in a private Git repo 2. Staging server for review and QA 3. Production deployment guide 4. Admin manual + user walkthrough video 5. Thirty days of post-launch bug fixing Acceptance criteria • All listed features working end-to-end under real test accounts • OWASP top-10 security checks passed, including CSRF, XSS, and SQLi protection • Page load under 2 seconds on 4G for main flows • Clear, intuitive UI for both brand and influencer roles If you’ve built marketplaces, escrow systems, or contract management tools before, show me a live link or repo and tell me what stack you used. Looking forward to ...

# Threads Fashion – Full-Stack E-Commerce Platform Live Demo: Threads Fashion is a production-ready e-commerce platform built with React...• DTO-based architecture for clean separation of concerns • Global exception handling and standardized API responses • Input validation and request sanitization • Integration and unit testing using JUnit and MockMvc • Modular, maintainable, and scalable codebase Security Features: • Spring Security 6 implementation • JWT-based stateless authentication • RBAC-protected administrative endpoints • XSS and injection attack protection • Secure OTP verification workflows Tech Stack: Java 17, Spring Boot, Spring Security, MongoDB Atlas, React 18, Vite, Docker, Razorpay, Twilio, Zoho Mail, Swag...

...engineer. Because the build relied heavily on AI assistance, I’d like a fresh pair of human eyes to make sure everything is production-ready. The key areas I need you to cover are: • Code verification – confirm the structure, style and logic are sound and maintainable. • Debugging – trace and resolve any hidden or obvious runtime errors. • Security testing – probe for vulnerabilities (injection, XSS, authentication flaws, misconfigured headers, etc.) and recommend or implement fixes. Tech stack details are a bit ambiguous; the codebase may include JavaScript, Python, Ruby on Rails or a mix, so I’ll provide you with full repository access and deployment notes at kickoff. Please be comfortable navigating an unfamiliar stack and d...

...fine). • Intuitive admin dashboard for creating, editing, scheduling, and categorising content. • Role-based access so I can safely delegate publishing rights to team members. • Structured product catalogue that supports rich descriptions, pricing fields and tags (no online checkout for now). • Fast page loads, SEO-friendly URLs, and protection against common security issues (SQL injection, XSS, CSRF). • Clear installation guide plus commented source code so future enhancements are straightforward. Please build with vanilla PHP, Laravel, CodeIgniter—or another well-supported framework if it speeds development—so long as the final app remains easy to maintain on a standard LAMP stack. On delivery I’ll review functionality agai...

I’m ready t... • REST or GraphQL API documentation for all account endpoints • Source code checked into a private Git repo with clear read-me for local setup Acceptance Criteria 1. New user can create an account, receive a verification email, and log in. 2. Returning user can update profile data and see changes reflected immediately. 3. All endpoints protected against common auth exploits (SQL-i, XSS, CSRF). 4. Front-end passes Lighthouse audit score ≥ 90 on performance and accessibility. Preferred stacks include Node.js + React or Django + Vue, but I’m open if you can justify another modern framework that delivers the same reliability and speed. Deploy to a test environment of your choice (AWS, DigitalOcean, or similar) so I can review pro...

I need a seasoned ethical hacker to run a full black-box penetration test against my own website. You will have no prior credentials or internal access; your job is to probe the public-facing application exactly as an external attacker would. Primary focus areas • SQL injection • Cross-site scripting (XSS) • Broken authentication I can supply formal, written authorization before any testing begins, ensuring everything is 100 % legal and above board. Please follow recognised methodologies such as OWASP Top 10, using tools you are comfortable with—Burp Suite, OWASP ZAP, Kali, or similar—combined with manual verification. Deliverables I expect • Executive summary outlining overall risk posture • Detailed technical report for each find...

...all three stores. • Perform the core upgrade to 3.0.4 or 3.0.5, adjust config paths, and switch servers to PHP 8.2+. • Patch or rewrite incompatible extensions and custom plugins, with special focus on Tshirtecommerce. • Preserve existing front-end customizations and confirm that page layouts render correctly on the new theme engine. • Run security hardening (permissions, .htaccess, CSRF & XSS checks) and clean up deprecated code. • Regression-test catalog, checkout, admin, and particularly every product-customization step. Acceptance criteria 1. All three sites load with zero PHP notices or OpenCart error logs. 2. Tshirtecommerce product-customization tools work end-to-end: design, add-to-cart, order placement, admin view. 3. Payme...

I need a seasoned security professional to perform an end-to-end audit of our custom web application and the public-facing site that supports it. The focus is firmly on discovering and documenting application-level vulnerabilities—SQL injection, XSS, authentication flaws, insecure APIs, misconfigured headers, anything that could slip past regular QA. Scope • Black-box and white-box testing of every user flow, admin panel, and API endpoint • Automated scanning with tools such as Burp Suite, OWASP ZAP, Nessus or equivalents, followed by manual verification • Review of server configuration files, access controls, and session management logic • Threat modelling to highlight realistic attack paths and business impact Deliverables 1. Full log set fro...

I need an experienced ethical hacker / cybersecurity professional to test my website for security vulnerabilities. The work must be legal, controlled, and limited only to my own website. Please check for issues such as: SQL injection XSS Login/security weaknesses File upload vulnerabilities Admin panel exposure WordPress/plugin issues, if applicable Server/header security SSL/HTTPS configuration Malware/backdoor checks General vulnerability report I need a written report showing: What vulnerabilities were found Risk level: low / medium / high / critical Proof of issue without damaging the site Clear steps to fix each issue Important: No destructive testing, no spam, no DDoS, no data deletion, and no testing outside my domain. Skills required: Ethical Hacking, Penetration Testi...

...password encryption/hashing • Protection against brute-force login attempts • Secure password reset and email verification functionality • Protection against spam and fraudulent applications • Secure session management • Secure database architecture • Restricted admin access permissions • Secure API/integration handling • Protection against common web vulnerabilities including SQL injection and XSS attacks Member information including: • Names • Addresses • Purchase history • Sizing profiles • Referral information • Membership activity must be securely stored and protected. Payment details should never be stored directly on the website and must be processed through secure third-party payment providers. The ...

...password encryption/hashing • Protection against brute-force login attempts • Secure password reset and email verification functionality • Protection against spam and fraudulent applications • Secure session management • Secure database architecture • Restricted admin access permissions • Secure API/integration handling • Protection against common web vulnerabilities including SQL injection and XSS attacks Member information including: • Names • Addresses • Purchase history • Sizing profiles • Referral information • Membership activity must be securely stored and protected. Payment details should never be stored directly on the website and must be processed through secure third-party payment providers. The ...

...development. TOOL SCOPE - Primary: SonarQube — required. Custom rule development using the SonarQube C# Plugin SDK / Roslyn analyzers. - Complementary (optional): Semgrep, CodeQL, Snyk Code. Experience with Fortify or Checkmarx is a bonus. - Supporting: OWASP Dependency-Check or Dependabot for SCA. GitLeaks / TruffleHog for secrets scanning. VULNERABILITY CLASSES — CUSTOM RULES REQUIRED SQL injection, XSS, CSRF, Auth/authz flaws, Hardcoded secrets, Sensitive data exposure, Unsafe deserialization, Weak cryptography, Insecure file uploads, Dependency misconfigurations, Razor (.cshtml) issues, ASP.NET-specific anti-patterns. DELIVERABLES 1. End-to-end CI/CD integration (GitHub Actions, Azure DevOps, or Jenkins) — every commit and PR triggers a scan; high-severit...

...message, and save it safely to the backend in the exact form it was entered. While I did not lock the brief to a single form style, it will likely resemble a concise contact or registration form (name, email, message/notes field). Whichever structure we settle on, every field must be: • Encoded so that all three character categories display correctly in every modern browser. • Sanitised to prevent XSS or injection attacks while still preserving the original characters. • Logged to the database or flat-file storage with no loss of data fidelity. Feel free to choose the tech stack you are most comfortable with—PHP, Node, Python, or a lightweight framework—as long as the final result is portable and straightforward to deploy on a standard Linux host...

...monitoring 10. Check Docker compatibility 11. Check the email system 12. Check domains/DNS 13. Check MariaDB and FTP/SFTP 14. Optimize performance 15. Check beginner mode 16. Check owner/super administrator permissions 17. Complete test of all features SECURITY REQUIREMENTS: * No dangerous or unrestricted shell commands * Secure Go agent only * Allowed commands * Protection against CSRF/XSS/SQL injections * Antivirus scan * File download protection * Security headers * Two-factor authentication (2FA) support * IP address protection * Full logs SYSTEM OF BACKUP: * Wasabi S3 compatible * Full server image backup * One-click restore * Backup verification * Scheduled backups DELIVERY REQUIREMENTS: * Production-ready installation * All modules are functional * ...

Scope of Work * Perform security assessment of web application (Python/Django) and APIs * Test authentication, authorization (RBAC), and session management * Identify vulnerabilities (e.g., SQLi, XSS, command injection, API abuse) * Assess Linux and Windows endpoint agents for: * Privilege escalation risks * Service configuration and permissions * Secure communication (TLS) * Evaluate on-prem server security: * Open ports/services * OS hardening * User access and permissions * Conduct network security testing: * Data in transit (encryption) * Internal communication paths * Review installation and deployment process: * RPM/package security * Configurations and secrets handling ⸻ Deliverables * Detailed security report with severity ratings *...

...WordPress admin credentials and GoDaddy account control will be provided as soon as the project starts. Feel free to use SSH, phpMyAdmin, WP-CLI, ImunifyAV or any other standard tooling you consider appropriate, provided no legitimate data is lost in the process. Deliverables • Complete malware removal from WordPress core files and affected themes • Closure of all discovered SQL injection, XSS and phishing vectors • Hardening actions inside cPanel and (file permissions, salts, firewalls, .htaccess rules, cron cleanup, etc.) • Update of WordPress, themes and plugins to their secure, current versions • Post-clean scan report summarising actions taken and tests passed • Optional 30-day monitoring script or security plugin configuration to ...

I need a Content Security Policy (CSP) configured to prevent XSS attacks effectively. Requirements: - Use nonces and hashes for both scripts and styles. - Allow self-hosted and specific sources only. Ideal Skills and Experience: - Strong understanding of CSP and XSS - Experience with nonces and hashes - Familiarity with configuring CSP for specific sources

...discrepancy issue in Google Analytics 4 (GA4) that needs investigation and fixing. Part 1 – Security Header Fixes (Pentest Findings) We need a developer experienced in web server configuration (Hostinger VPS) and/or Cloudflare/CDN settings to address the following three findings: Finding 1 – Duplicate Security Headers Misconfiguration (CVSS 2.6) Headers like X-Frame-Options, X-Content-Type-Options, and X-XSS-Protection are being sent multiple times in the HTTP response. The fix requires consolidating these headers across all layers — web server, PHP backend, and CDN — so each header appears exactly once. Finding 2 – Information Disclosure via Headers (CVSS 2.6) The server is exposing backend technology details through custom headers (X-Flying-Press-...

...Elementor 3.35.8 -> 4.0.2 - Elementor Pro (already latest) - JetEngine -> 3.8.8 - Jetpack Protect -> 5.0.0 - Limit Login Attempts -> 3.1.0 - ManageWP Worker -> 4.9.33 - Really Simple SSL -> 9.5.9 - Insert Headers and Footers -> 2.3.5 - WPForms -> 1.10.0.4 - WP Headers and Footers -> 3.1.4 - Yoast SEO -> 27.4 SECURITY HARDENING: - Added security headers (X-Frame-Options, X-Content-Type-Options, X-XSS-Protection, Referrer-Policy) - all verified working - Disabled file editing in wp-admin (prevents hackers from editing theme/plugin files if they get in) - Hidden WordPress version number from page source - Blocked user enumeration (author archive redirects) - XMLRPC was already blocked by the hosting (good) - Activated Activity Log plugin to track futur...

...high-speed PHP or Python web-dashboard that fetches User ID and Balance from my existing PostgreSQL DB via a secure URL token. Iron-Clad Security (Crucial): Device Fingerprinting: One device, one account only. VPN/Proxy Detection: Block all tasks if a user is on a VPN/Proxy (mandatory for CPA/AdMob/Unity). Anti-Fraud: Root/Jailbreak detection and Emulator blocking for the webview. SQL Injection & XSS Protection: Secure all database queries. Ad-Network Ready: The webview must be optimized to load iframes for Unity, AppLovin, and CPA Offer Walls without breaking the session. Postback Integration: Ensure the existing postback script correctly updates the PostgreSQL database when a task is completed on the web. Budget: $30 - $50 (Fixed) Note: I am a technical person and will prov...

...context, streaming, tool use, vision Document the measured savings ratio with raw data Flag any discrepancy between marketed claims and measured results 3. Security testing API key handling: verify AES-256-GCM encryption at rest, audit key lifecycle, test for leakage in logs, error messages, and network traffic Authentication and session security (OWASP Top 10) Input validation, injection attacks, XSS, CSRF PII scrubbing verification — confirm the claim that prompts are scrubbed server-side before indexing Penetration testing of the key storage and retrieval path TLS configuration, headers, CSP 4. Performance and reliability Latency added by the middleware layer vs. direct Claude API calls Throughput under concurrent load (target: 100 concurrent users) Streaming perform...

...strategies, and highlight edge-case pitfalls that only surface in production. • Code: provide self-contained snippets (C/C++, Rust, and optionally JavaScript for browser hooks) that compile or run as-is, accompanied by short explanations of why each decision was made. • Context: discuss memory‐safety, performance overhead, debugging tips, and security implications such as preventing DLL hijacking or XSS vectors. • Visuals: include simple architecture diagrams or sequence charts (exported PNG/SVG). A lightweight Markdown file is perfect for this. • Originality: everything must be your own work; no copy-paste from public blogs or vendor docs. Delivery format 1. Markdown (.md) file containing the article, code blocks, and image references. 2. Separate ...

...pipelines, and recording credit systems. 10. Chat & Notifications Test real-time chat (Durable Objects WebSocket), message persistence (D1), and unauthorized access prevention. Validate Courier notifications and the referral code system. 11. Admin Dashboard Test admin route protection, audit logs, feature flags, and AI cost analytics. 12. Security & Hardening Scan for SQL injection (D1 queries), XSS (dangerouslySetInnerHTML), and CSRF. Run Lighthouse audits and check GDPR account deletion (purge D1, KV, R2). 13. Minor UI/UX adjustments may be required as part of the scope. The developer should also be open to handling small to mid-level backend enhancements or feature updates if needed. Expected Deliverables Bug Report: Comprehensive list of bugs (file name, li...

...and want a qualified ethical hacker to run a full-scale penetration test against the public-facing web application. The priority is website & application-level weaknesses, so I expect you to probe everything users can touch: signup, log-in, wallets, odds display, live bets, admin panels behind authentication—every feature that might be exploited. Please include the usual suspects—SQL injection, XSS, CSRF, IDOR, authentication bypass, file upload issues, business-logic flaws—essentially the OWASP Top 10 and anything else you uncover during your manual and automated reconnaissance. Black-box testing is preferred at first; if you later need limited credentials for deeper inspection we can arrange that. Deliverables I need: • A concise executive summary h...

...data (credentials, PII, tokens) stored insecurely on the device (e.g., in SharedPreferences, Plist files, SQLite databases). Insecure Communication: Analyze network traffic to/from the app to ensure encryption is properly implemented (TLS/SSL) and to check for certificate pinning issues. Client-Side Injection: Test for vulnerabilities like SQL Injection in local databases or Cross-Site Scripting (XSS) in WebViews. Broken Authentication & Session Management: Test for weaknesses in login, logout, session handling, and credential management on the client side. Code Obfuscation & Reverse Engineering Resistance: Assess the difficulty of reverse-engineering the application. 2. API / Server-Side Testing: API Endpoint Discovery and Mapping: Identify all API endpoints used by the...

Please Sign Up or Login to see details.

...verification Non-Functional Testing • Load testing • Performance testing • Stress testing • Scalability testing • Concurrency testing • Stability and reliability testing Security Testing • Vulnerability assessment • Penetration testing • Authentication and authorization validation • Role-based access control testing • Session management testing • Input validation checks • Protection against SQL Injection, XSS, CSRF Integration & Data Testing • Data consistency and reconciliation • Error handling and retry mechanisms ERP-Specific Controls • Financial data integrity • Transaction consistency • Approval workflows • Multi-user / multi-company scenarios • Compliance and audit requir...