Independent technical audit of a live bilingual React, Node.js and PostgreSQL platform, covering security, permissions, store isolation, QR, loyalty, database migrations, RTL interfaces and deployment readiness. Review and report only—no production change

@shrec

Hi, Your focus on an independent, read-only audit before onboarding the first real store is clear. The review should go beyond surface-level code checks and specifically validate tenant isolation, server-side authorization, QR and loyalty transaction safety, migrations, and pilot readiness. I would approach the audit by testing the application and APIs from both expected and unauthorized paths, including cross-store and cross-branch access attempts. For QR redemption and loyalty points, I’d test duplicate and concurrent requests against a disposable database to identify race conditions and transaction integrity issues. I’d also review migrations with up/down testing, rollback and backup procedures, while separately checking RTL/LTR behavior and responsive layouts. I can provide the requested findings with reproduction steps, evidence, affected areas, business/security impact, priorities, and a clear pilot-readiness decision. I accept the confidentiality and no-production-change requirements. For the review only, my fixed price is $600 USD with delivery within 7 days. Best, Ivane

@diektech

Hi, I'm Elias, a Miami-based senior software engineer with 20 years of experience in full-stack development. I specialize in React, Node.js, and PostgreSQL, making me a great fit for your project. I understand you're looking for a technical audit of your bilingual platform, focusing on security, permissions, and deployment readiness. I've conducted similar audits assessing secure architecture and user permissions. My approach would involve: 1) Assessing the existing architecture and workflows 2) Reviewing security protocols and permissions 3) Evaluating database migration processes 4) Analyzing deployment readiness 5) Compiling a comprehensive report with actionable insights Could you please clarify the following questions to help me better understand the project? 1) What specific security concerns should I prioritize? 2) Are there existing user role definitions for the permissions audit? 3) Can you describe any edge cases in the store isolation feature? I have built similar systems before, and most of my projects were completed under NDA, so I can't publicly share them, but I’d be happy to walk you through the architecture, features, and technical decisions I made. I will also ensure the report includes recommendations for a maintainable codebase, helping keep the platform robust for future enhancements.

@Microlent

Hello, I am Dr. Rajesh Rolen, PhD in Computer Science & Engineering, with experience of over 20+ years in React.js, Website Testing, REST API, Typescript, Software Testing, PostgreSQL, Node.js, Web Security As a preferred freelancer in the top 1%, I have done 400+ projects here on freelancer.com, I have 4.9 ratings out of 5 on average, which showcases my quality of work and timely delivery. Key Highlights: - Free Hosting Support on the Cloud or any desired platform. - Free 3 months of post-delivery support to ensure that our client doesn’t face any challenges after the launch of the project. - Free Dedicated tester on projects to ensure quality delivery, so clients don’t need to act as a tester. - 10+ Years experience UI/UX team to ensure intuitive UI. Portfolio: https://www.freelancer.com/u/Microlent Please open the chat and send me a message, so we can have a more detailed discussion about the project to give you the project timeline and cost. Thank you for considering my services. I look forward to engaging in a productive conversation and understanding how I can be of assistance in bringing your project to life. Regards Rajesh Rolen

@DeveloperStation

Hi, For a multi-tenant audit like this, the first thing I test is server-side authorization by hitting the REST endpoints directly with a store manager token and trying to read another store's offers, branches and loyalty ledger. Interface restrictions mean nothing if the API trusts the caller. For QR and points, I run concurrent redemption requests against a disposable Postgres copy to catch race conditions and double-spend where the check-then-write is not transactional. We build and deploy React and Node platforms on DigitalOcean with Postgres, migrations and CI/CD, so I can review the code, schema and deployment from the inside and report against it. One question: do you use Drizzle transactions around redemption and points, or application-level locking? That shapes the concurrency findings I focus on first. Adil

@Rekhathakur

Hello, With over a decade of experience in web development and database management, our proficiency in dealing with complex technologies such as PostgreSQL puts us in an advantageous position to conduct a detailed yet efficient audit on your Chance Plus platform. Our portfolio, which includes designing, developing, and optimizing online stores, speaks to the expertise we bring to the table - not just to create, but also understand, enhance, and secure existing systems. Our specialized skills in various eCommerce platforms is well-suited for this project encompassing React, Node.js, and PostgreSQL; technologies that we have been working with for years. Consequently, your needs for structural review, security enhancement, and permission management align closely with our fortes. Moreover, we are seasoned in managing live systems without disrupting production runs-an essential aspect of the audit you require. Beyond technical competence though, we also underscore our commitment to client satisfaction and open communication. As such, you can expect transparency at every stage of the process: from our analysis to delivering meaningful reports. Building long-term relationships with clients is something we thrive on- recognizing that successful projects extend beyond their immediate impact. Thank you

@corpmember29

Hello, SENIOR FULL-STACK TECHNICAL AUDITOR — I HAVE AUDITED SIMILAR LIVE REACT, NODE.JS, POSTGRESQL AND MULTI-TENANT PLATFORMS BEFORE AND CAN SHOW YOU. I have carefully reviewed your requirements and understand that this is strictly an independent technical audit of your live Chance Plus platform, with no production changes, writes, deployments, or modifications. I have 11+ years of experience with TypeScript, React, Node.js, Express, PostgreSQL, REST APIs, Drizzle ORM, migrations, CI/CD, and cloud deployments. I can systematically audit the architecture, authentication, RBAC, cross-store/branch isolation, APIs, QR redemption, loyalty ledger, database migrations, RTL/LTR interfaces, and deployment readiness. For security and permission testing, I will use local/disposable environments wherever possible and provide clear evidence, reproduction steps, affected files/endpoints, business impact, severity, and recommended corrections without implementing them. The final report will include an executive summary, pilot-readiness decision, Critical/High/Medium findings, verified working areas, test coverage, migration/rollback assessment, and final launch checklist. I fully accept the confidentiality and no-production-change requirements. Thanks, Christina

@gotucat

Hi, I reviewed the project and understand that the main requirement is an independent, read-only technical audit of the live bilingual Chance Plus platform before its first store pilot. The review must cover security, permissions, multi-store isolation, QR redemption, loyalty, migrations, RTL interfaces, and deployment readiness without production changes. I’ll assess the React, Node.js, TypeScript, PostgreSQL, REST API, CI/CD, and deployment implementation through structured testing and Security Auditing. I’ll document evidence, reproduction steps, affected areas, business impact, coverage gaps, and prioritized pilot-readiness recommendations, including cross-store access, concurrent redemption, migration rollback, and API authorization checks. I’ll provide a clear executive decision and detailed report while keeping all source code and business information confidential. Careful communication and clean evidence will make findings easy to manage. Let’s discuss here now.

@usmanbashir12100

Hi, I can conduct an independent, evidence-driven audit of Chance Plus without modifying production, covering the TypeScript/React/Node.js/PostgreSQL stack, architecture consistency, authentication, server-side authorization, multi-tenant isolation, concurrency, QR redemption, loyalty ledger integrity, migrations, CI/CD, and Arabic RTL responsiveness. Testing would use local or disposable environments where possible, with reproducible findings, prioritized business impact, and a clear pilot-readiness decision supported by documented coverage and gaps. A few questions: Is there an existing automated test suite, staging environment, and disposable database setup available for the audit? Can controlled source access include the full migration history, CI/CD workflows, OpenAPI specification, and relevant deployment configuration? What fixed audit delivery window do you expect after repository and documentation access is provided? Best regards, Muhammad Usman

@denisSolution

Hi, I'm Denis, a full-stack developer specializing in auditing multi-tenant platforms built with React, Node.js, TypeScript and PostgreSQL. I've identified permission gaps, race conditions and security issues across multi-store systems where data isolation is critical. For Chance Plus, I'll conduct a thorough independent review covering: - Code quality, architecture, and authentication/API security - Role-based permissions and data isolation across stores and branches - Employee and offer workflows, QR redemption concurrency, loyalty points handling - Database migrations and rollback safety - Arabic RTL and responsive design - Deployment readiness You'll receive a prioritized findings report with evidence and reproduction steps. My approach: 1. Full code review of React frontend, Node.js API and PostgreSQL schema 2. Systematic permission testing via direct API access to verify store isolation and role enforcement 3. Heavy focus on QR and loyalty workflows—testing for race conditions using concurrent requests to catch duplicate redemption risks 4. Review migrations for data-loss risks and test rollback procedures 5. Verify Arabic/English interfaces across devices and CI/CD readiness I'll emphasize concurrent transaction safety. QR redemption and loyalty points are timing-sensitive operations where simultaneous requests could cause duplicates or race conditions. I'll test these rigorously. Key risks: unclear permission boundaries between stores/branches (allowing data lea

@Herculesz

Hi, This audit requires a deep technical review of a live bilingual React, Node.js, and PostgreSQL platform with a focus on security, permissions, and deployment readiness. The main engineering risk lies in verifying store isolation and data integrity without impacting production. I usually structure audits by first validating data access boundaries and security controls at both the database and API layers. My experience with codebase reviews and backend/frontend integration aligns well with this task. I typically design the review process to separate concerns around security, localization (including RTL), and deployment pipelines to ensure comprehensive coverage. I would first validate the permissions model and database migration strategies to assess risk and readiness. This approach ensures the platform can safely scale and maintain bilingual features. Systems like this require careful attention to deployment automation and interface consistency, which I routinely evaluate for production reliability. I can provide a detailed audit report mapping findings to remediation priorities and deployment risks. Thanks, Hercules

@Eliteinno

The audit scope for Chance Plus is extensive, especially concerning its multi-tenant architecture and security. Identifying cross-store and cross-branch access issues will likely hinge on thorough role-based access control reviews and testing API endpoint protections against unauthorized access. For QR redemption and loyalty points, concurrent operation tests should include simulating race conditions using a disposable database. Ensuring the migration process is safe involves running up-and-down tests to catch destructive changes before they affect production. What current test environments are available for simulating these operations without touching production systems?

@juanestebana17

Hello! I understand you need an independent technical audit of the live bilingual Chance Plus platform, covering security, permissions, store isolation, QR redemption, loyalty, PostgreSQL migrations, RTL interfaces, and deployment readiness without any production changes. I’ve spent the last several years solving exactly this type of problem across React, Node.js, TypeScript, and PostgreSQL systems, including CI/CD, Website Testing, and PostgreSQL review work on existing codebases built by other teams. I’m comfortable auditing multi-tenant permissions, cross-store data isolation, concurrency risks, migration safety, and production readiness, and I can produce a clear report with evidence, reproduction steps, and prioritized findings. I’m ready to get started, and I’m confident we can make this project a success and deliver it to a high standard. I’m committed to ensuring everything is completed professionally, efficiently, and exactly according to your requirements. Best regards!

@AZTURK1

Hi, I reviewed your brief carefully—you need an independent technical audit of the live Chance Plus platform before onboarding the first real store, and critically, no production changes during the review. You're right to want this done before going live with real data. I'll run a full security and architecture audit covering authentication and session handling, API authorization enforcement (not just UI-level), store isolation across all endpoints, QR redemption flow and race-condition protection, loyalty points ledger integrity with auditable reversals, database migration safety on a disposable PostgreSQL instance, Arabic RTL and English LTR interface consistency, and CI/CD/deployment readiness on DigitalOcean. I'll deliver a prioritized findings report with evidence, reproduction steps, affected files/endpoints, business impact, and recommended fixes—plus an executive summary with a clear pilot-readiness recommendation. ✅ Web Security & Authorization Testing ✅ PostgreSQL Schema, Migrations & Data Isolation Audit ✅ Node.js/Express API & TypeScript Code Review ✅ React/Vite Frontend, RTL/LTR & Responsive Testing ✅ CI/CD Pipeline (GitHub) & DigitalOcean Configuration Review ✅ Race-condition & Concurrency Testing (disposable DB, no production writes) ✅ Microsoft® Certified: MCSA | MCSE | MCT ✅ 300+ projects delivered, 280+ five-star reviews I'm a senior engineer with 7+ years in production environments—I know how to test thoroughly without breaking things.

@mayr81

Conduct a read-only, independent technical audit of the live bilingual Chance Plus platform (React/Vite, TypeScript, Node/Express, PostgreSQL, Drizzle, REST/OpenAPI, PWA, RTL). Deliver an executive readiness decision plus prioritized findings with evidence and exact reproduction steps. Scope covers security (auth/session/cookies, input validation, secrets/config, authorization enforcement), RBAC and multi-store/branch data isolation (including direct API bypass attempts), store employee workflows, offer lifecycle (draft/approval/status transitions, duplicate/excess redemption prevention), QR generation/validation/redemption concurrency and race-condition safety, loyalty ledger correctness (auditable reversals, per-store visibility), and database schema/migrations with disposable up/down migration and backup/rollback risk review. No production code changes, no PR merges, no production DB writes or test records, and no emails/SMS/auth codes. I will review CI/CD and deployment readiness at a read-only level (health, logging/monitoring) and provide a pilot-readiness checklist and a separate correction plan only for confirmed issues (not implemented).

@ozbas

With over a decade of experience as a Full-Stack developer, I am confident that my skills in Node.js, PostgreSQL, React.js and Typescript make me the perfect fit for your independent technical audit. I have a deep understanding of web and mobile applications, which aligns well with the bilingual React and Node.js platform that you have described. Security is undoubtedly a top priority for your platform, and my experience with implementing secure authentication, sessions, cookies, and account access makes me well-prepared to review and validate these aspects. Moreover, given the complexity of your offering process and customer transactions, I can bring my expertise in QR code validation, security workflows associated with offers and loyalty programs to ensure there are no unintended loopholes or vulnerabilities. Data isolation and maintaining strict permissions for store employees are critical too. Having worked extensively with multi-role multi-permission systems before like you described where different roles needed access to specific resources without compromising on security or data integrity. Overall my broad skillset combined with my attention to detail can offer the comprehensive technical audit your platform needs. It would be an honor to contribute my decade-long expertise to evaluating your Chance Plus platform

@smitk9999

I understand you need an independent audit of Chance Plus before onboarding the first store. I will review, test and report only, with no production changes. 1. Relevant work: I will share it once you contact me. 2. I have audited existing code, APIs, databases, security and deployment readiness. 3. I previously found APIs that needed stronger server-side tenant ownership checks. 4. I will test cross-store and branch access by changing resource IDs in direct API requests. 5. I will test QR and loyalty duplication using simultaneous requests in a disposable environment. 6. I will test migrations, rollback, backup and restore on a separate PostgreSQL database. 7. I have experience with Arabic RTL, English LTR, responsive layouts and browser testing. 8. I can provide a simple anonymized audit-report format. 9. I accept all confidentiality and no-production-change requirements. 10. Fixed price: $750 USD. Delivery: five business days. I can start work right away. Contact me to discuss more details. Thanks. Smit

@CorporateRD

Hi there, You already have Chance Plus live with React, Node.js, Express and PostgreSQL, so the important question is whether the current implementation can safely handle its first real store. We’ll audit what is already built rather than proposing a rebuild. We’ll focus on the areas that can create serious pilot issues: cross store and branch data isolation, server side role enforcement, offer approval states, QR redemption limits and race conditions, loyalty point reversals, PostgreSQL migrations and rollback safety. We’ll also verify Arabic RTL flows, API consistency, production builds, CI/CD and DigitalOcean deployment readiness without making production changes. Have you already prepared a disposable PostgreSQL database for migration and concurrency testing? Can you provide the current automated test suite, if available? Is the first pilot store workflow already defined for acceptance testing? We’ll return a clear pilot readiness decision with evidence, reproduction steps, affected areas and prioritized corrections. Budget and Timeline are placeholders. Regards, Royal Designs (FK)

@sabaehsan

Greetings, I see you're looking for a senior technical auditor to conduct a thorough review of your bilingual Saudi offers and loyalty platform, Chance Plus. My approach would involve a detailed examination of the existing code and architecture, focusing on security, permissions, and overall readiness for a controlled pilot with your first store. I understand the importance of ensuring that customer and store data is isolated and that the platform is compliant with security best practices, especially given its current live status. My experience includes auditing applications built with React, Node.js, and PostgreSQL, along with a strong background in application security. I've tackled multi-tenant permission issues and successfully tested QR redemption systems in previous projects. I’m also familiar with RTL interfaces, ensuring they function seamlessly across different languages. I appreciate the confidentiality and no-production-change requirements and am ready to maintain the integrity of your platform during this audit. Best regards, Saba Ehsan

@emilesd617

Hi, I am a senior full stack technical auditor with 8 years of rich experience in software development, with a background in reviewing existing applications, security testing, API integrations, database systems, multi tenant platforms, and deployment architecture. I am familiar with TypeScript, React, Node.js, PostgreSQL, REST APIs, software testing, web security, security auditing, CI/CD, database migrations, and PWA applications. For Chance Plus, I can perform a read only technical audit across the application, API, database, permissions, and deployment setup. I can specifically test cross store and cross branch isolation, direct API authorization, QR redemption and loyalty concurrency, migration rollback risks, authentication and common security issues, as well as Arabic RTL and responsive interfaces. I will document reproducible evidence for each finding, prioritize launch blockers, and provide a clear pilot readiness decision without making any production changes. I'm an individual freelancer and can work on any time zone you want. Please contact me with the best time for you to have a quick chat. Looking forward to discussing more details. Thanks. Emile.