Browse categories
Explore
Fiverr Pro
English
$
USD
I will do PHP laravel security audit and vulnerability report
Umar A
About this gig
Is your PHP or Laravel application leaking sensitive data right now?
I will perform a thorough security audit of your PHP or Laravel application and server the same process used by professional penetration testers.
WHAT I CHECK:
Exposed config files, .env, database.php, authkey files
phpinfo and debug pages left open in production
Xdebug or Telescope running on live servers
Outdated PHP, OpenSSL and dependency CVEs
composer.json and vendor directory public exposure
Laravel misconfiguration APP_DEBUG, error display
SQL injection, XSS and CSRF vulnerabilities
robots.txt disclosing internal paths
HTTP security headers audit
YOU RECEIVE:
Professional PDF report severity rated findings
Clear impact explanation for each issue
Step by step remediation instructions
Executive summary you can share with your team
I have found critical vulnerabilities in live production systems including remote code execution vectors and publicly exposed server configurations. Real experience, not automated scanner output only.
Message me your URL before ordering I confirm scope within 1 hour.
Get to know Umar A
Umar A
Senior Full Stack Engineer
- FromPakistan
- Member sinceApr 2026
- Avg. response time1 hour
Languages
Urdu, English
Senior Laravel & Vue.js engineer with 10+ years building ERP systems, SaaS platforms, and custom business applications. I've delivered full-scale ERPs for auto dealerships and claims
management companies, inventory systems, security audits, and WCAG accessibility compliance.
Stack: Laravel · Inertia.js · Vue 3 · MySQL · REST API · Tailwind CSS
I build systems that work properly — not patches. Message me before ordering and I'll confirm scope within the hour.
My Portfolio
FAQ
Do you need access to my server or source code?
No server access is needed for the Basic and Standard packages. I perform a black-box audit — testing only from the outside, the same way a real attacker would. For the Premium package and the Source Code Review extra, you can optionally share a GitHub repo or zip file for deeper analysis.
What PHP frameworks do you audit?
I specialize in Laravel and plain PHP applications. I also audit CodeIgniter, Symfony, and custom PHP codebases. For Laravel specifically I check framework-level misconfigurations that generic scanners miss — APP_DEBUG, Telescope exposure, queue dashboard access, and more.
Will you actually exploit any vulnerabilities?
No. I identify and document vulnerabilities without exploiting them. The goal is a clear report your team can act on — not demonstrating how far an attacker could go. All testing is non-destructive and does not modify any data or files on your server.
What does the PDF report look like?
Each finding gets its own section with a severity rating (Critical, High etc.), a plain-English description of the issue, the exact URL or file path affected, the potential impact if exploited, and step-by-step remediation instructions, it includes an executive summary for non-technical stakeholders
How is this different from running an automated scanner?
Scanners like ZAP or Nessus often miss exposed configs, phpinfo leaks, Xdebug, and logic flaws. My audit combines automated tools with manual review. Manual review is what catches the critical findings that actually matter.
What if no serious vulnerabilities are found?
You still receive the full PDF report documenting everything checked and confirmed clean. A clean audit report has real value — you can share it with clients, investors, or your team as proof of security due diligence. This is especially useful for SaaS products and platforms handling user data.
Can you audit a live production site without downtime?
Yes. All testing is passive and read-only — I never send destructive payloads or perform actions that could affect uptime. Your site stays online and functional throughout the entire audit. I also avoid peak traffic hours for any active testing steps.
Do you test for OWASP Top 10 vulnerabilities?
Yes. The audit covers the OWASP Top 10 including injection flaws, broken authentication, sensitive data exposure, security misconfiguration, vulnerable components, and more — applied specifically to PHP and Laravel applications rather than as a generic checklist.
Is this legal?
Yes — I only audit domains you own or have written authorization to test. Before starting I will ask you to confirm you have permission to test the target. I do not perform unauthorized testing under any circumstances. If you need a signed NDA before sharing details, I am happy to provide one.
Can you fix the vulnerabilities after the audit?
Yes. The Premium package includes fixing all critical and high severity findings. For Basic and Standard packages, fixing is available as an add-on. Message me after reviewing your report and I will quote a remediation scope based on what was found.
