Security Assessment & Remediation Retest - Jaspersoft Reporting Environment
Budget / SalaryA$1,500–2,000
TypeFreelance project
LocationRemote
Posted1 hour ago
We need an experienced security researcher for a defined, time-boxed engagement on a web-based reporting environment built on Jaspersoft. The work covers written reports, a passive external review and one authorised retest after fixes are in place. We are inviting one freelancer only.
DELIVERABLES (40 hours max, AUD $50/hr)
D1 - Activity record (6 hrs): A full written record of prior testing activity on the environment, including dates, times with timezone, source IPs, tools, commands and any files accessed. Accepted when complete, signed and matching our logs.
D2 - Technical write-up (8 hrs): The vulnerability chain, root causes, severity, and recommended fixes for Jaspersoft and the hosting servers. Accepted when our team can reproduce it from the write-up alone.
D3 - Passive external exposure review (10 hrs): A review of publicly visible subdomains, using public sources only. Every item must list its source; no active probing.
D4 - Authorised retest (10 hrs): A retest after remediation, confirming whether each fix from D2 holds. Must cover every D2 finding and follow the rules of engagement.
D5 - Q&A support (up to 6 hrs): Answering questions from our team and our security partner, including a 30-minute video check-in after each deliverable.
Hours may move between deliverables with our written approval. The 40-hour total stays fixed.
OUT OF SCOPE
Access to internal systems, logs or customer data; the wider investigation; any testing outside the written rules of engagement; downloading or keeping any data; publishing or sharing the work.
RETEST RULES (D4)
The retest starts only after a signed authorisation letter and completed remediation.
- Test only the named targets, inside the agreed time window, from IPs declared in advance.
- No downloading or keeping data. Prove access with the minimum evidence possible.
- No persistence, lateral movement, load testing, fuzzing or brute force.
- Stop and report right away if personal information is exposed or anything unexpected happens.
- Use only the test credentials we provide, and destroy them afterwards.
TERMS
- An NDA is required; everything about this engagement is confidential during and after the term.
- No blog posts, talks, social media or portfolio use without written consent.
- We own all deliverables.
- Payment is by milestone, per deliverable, on written acceptance.
- Communication happens only through the channels we provide.
- Either party can end the engagement with written notice; we pay for accepted deliverables only.
DELIVERABLES (40 hours max, AUD $50/hr)
D1 - Activity record (6 hrs): A full written record of prior testing activity on the environment, including dates, times with timezone, source IPs, tools, commands and any files accessed. Accepted when complete, signed and matching our logs.
D2 - Technical write-up (8 hrs): The vulnerability chain, root causes, severity, and recommended fixes for Jaspersoft and the hosting servers. Accepted when our team can reproduce it from the write-up alone.
D3 - Passive external exposure review (10 hrs): A review of publicly visible subdomains, using public sources only. Every item must list its source; no active probing.
D4 - Authorised retest (10 hrs): A retest after remediation, confirming whether each fix from D2 holds. Must cover every D2 finding and follow the rules of engagement.
D5 - Q&A support (up to 6 hrs): Answering questions from our team and our security partner, including a 30-minute video check-in after each deliverable.
Hours may move between deliverables with our written approval. The 40-hour total stays fixed.
OUT OF SCOPE
Access to internal systems, logs or customer data; the wider investigation; any testing outside the written rules of engagement; downloading or keeping any data; publishing or sharing the work.
RETEST RULES (D4)
The retest starts only after a signed authorisation letter and completed remediation.
- Test only the named targets, inside the agreed time window, from IPs declared in advance.
- No downloading or keeping data. Prove access with the minimum evidence possible.
- No persistence, lateral movement, load testing, fuzzing or brute force.
- Stop and report right away if personal information is exposed or anything unexpected happens.
- Use only the test credentials we provide, and destroy them afterwards.
TERMS
- An NDA is required; everything about this engagement is confidential during and after the term.
- No blog posts, talks, social media or portfolio use without written consent.
- We own all deliverables.
- Payment is by milestone, per deliverable, on written acceptance.
- Communication happens only through the channels we provide.
- Either party can end the engagement with written notice; we pay for accepted deliverables only.
Apply on Freelancer →
Project sourced from Freelancer.com. Applications happen directly on the original platform — we never collect your data.