Independent AWS, MERN Web Application and API Cybersecurity Penetration Test

I’m preparing Land Connect Hub—a MERN-based application running on AWS—for production and need a thorough security health-check before launch. The system stores highly sensitive data: user profiles, identity-verification documents, land and genealogy records, service requests, subscription details and, soon, payments through the Bank of the Cook Islands TakuEcom gateway. Because of that breadth, I want an independent professional to combine penetration testing with a full architectural review.

What I expect you to cover
• Front-end React app, Node/Express APIs and MongoDB queries
• Identity workflows, role management and administrator privileges
• File handling in S3, object-level permissions, encryption at rest/in transit
• TakuEcom payment flow and webhook handling
• IAM policies, network configuration, logging, monitoring, backup and recovery strategies

Please follow recognised standards such as OWASP Top 10, ASVS and relevant CIS Benchmarks, blending automated scans with manual exploitation techniques to surface logic flaws. Testing must be non-destructive and coordinated so my staging environment remains stable.

Deliverables
• Executive summary for non-technical stakeholders
• Detailed technical report: findings, CVSS rating, reproducible proof-of-concept steps and concrete remediation guidance
• Prioritised remediation roadmap
• Optional retest after fixes (quote separately)

Add a brief outline of your methodology, sample report pages and realistic turnaround time when you reply. I’ll provide staging credentials and a signed NDA before work starts.