Browse categories
English
$
USD
Connect to your AI
I will do web app penetration testing and API security testing
Making your Application Ideas a Reality
Hey there!
I’m a London-based software engineer with 9+ years of experience in full-stack development. I’ve built scalable web applications using JavaScript, React, and Node.js, and deployed them to ...
Vetted by Fiverr Pro
Joshua D was selected by the Fiverr Pro team for their expertise.
Vetted for
Cybersecurity
Software Development
About this Gig
Vetted Pro
I'll do hands-on penetration testing of your web app or SaaS and its API, against the OWASP Top 10 and OWASP API Top 10, then give you a report your developers can actually work from.
I'm a vetted Fiverr Pro in cybersecurity and a full-stack engineer who builds SaaS apps for a living. So the fixes I write are practical and ready to go into your codebase.
What I test
- Authentication and session handling
- Access control and IDOR
- Injection, XSS, CSRF and SSRF
- Security headers and exposed secrets
- Rate limiting
- Vulnerable dependencies
I use a mix of manual testing and tools like Burp Suite, OWASP ZAP and network scanners. Every finding gets a severity rating, proof of concept steps and a clear fix.
I only test systems you own or have written permission to test. Written authorisation and scope are confirmed before any testing starts.
Standard and Premium include a retest once your fixes are in. If you're not sure which one fits, message me with a link to your app and I'll point you to the right one.
Expertise:
Audit
•
Configuration management
•
Risk assessment
Technology:
Cloud - IaaS
•
Saas
•
Databases
•
Web application
Clients I’ve worked with
Audeze
Completed the development of a custom image rotator component for a Shopify integration used to sell Audeze headphones. The component allows customers to interactively rotate product images, giving a clear, 360-degree view of the headphones directly within the product page. It was built to integrate cleanly with Shopify’s theme architecture, ensuring fast load times, smooth interaction, and respon
Nov 2025-Dec 2025
My Portfolio
Other Cybersecurity Services I Offer
FAQ
Do you need permission to test my app?
Yes, always. I only test systems you own or have written permission to test. Before I start you confirm that in writing along with the scope, the URLs and anything that's off limits.
Will testing take my site down?
It shouldn't. I keep testing controlled, avoid denial of service style attacks and agree any heavier checks with you first. Any security testing carries a small risk though, so taking a backup before we start is sensible.
Should you test staging or production?
Staging is best if it matches production closely, as I can test more freely there. If production is the only option that's fine, I'll just be more careful and we can agree a time window.
What's in the report?
Every finding with a severity rating, where it is, proof of concept steps to reproduce it, and a fix written for developers. Premium also gets an executive summary for founders or investors.
Do you retest after we fix things?
Yes, on Standard and Premium. Once your fixes are in I retest those findings and update the report so you've got a clean record. Basic doesn't include a retest, so go for Standard if you want one.
