Refactor & Upgrade Laravel + Vue 3 Platform

Project: Complete Refactor & Security Upgrade — Laravel + Vue 3 Platform

- Objective

We are looking for a senior full-stack developer (Laravel + Vue 3) to refactor and upgrade our existing web platform to a 10/10 level in security, scalability, stability, and code quality. The current codebase functions, but it must be professionally restructured to reach production-grade standards.

Scope Overview:

The goal is to deliver a codebase that is:

Fully secure (no secrets in repo, headers, CSP, HSTS, rate-limiting, etc.)

Modular and scalable (feature-based architecture, centralized API services, Pinia store)

Clean and maintainable (zero warnings, lint + CI passing)

Properly tested and monitored (unit/integration tests + error tracking)

Optimized and stable (faster load, modular build, CI/CD pipeline)

- Security Requirements (Before Development)

Before starting development, all critical credentials must be rotated:

VPS access keys

Backup system credentials

Email/SMTP credentials

This ensures a clean and secure environment with no legacy or unauthorized access.

- Detailed Work Plan (Milestones and Deliverables)

Each milestone must be delivered as a separate, verifiable GitHub Pull Request (PR) with commits and live verification on the staging environment.
Each PR must be approved before the next milestone begins.

-Phase 0 – Critical Security & Containment (12 h)

Remove secrets from the repo and rotate credentials.

Enforce HTTPS, secure cookies, .env.example template.

Add security headers (HSTS, CSP enforce, X-Frame-Options, Referrer-Policy).

Restrict CORS to official domains.

Add rate-limiting to critical routes.
Deliverable: PR merged; headers, rate limits, and credential rotation verified via staging.

- Phase 1 – Stable Toolchain & Build (12 h)

Update Node LTS, Vue 3, Vite, Axios.

Clean vite.config, Tailwind setup, and aliases.

Remove dev-only assets (Telescope, etc.).

Add ESLint + Prettier.
Deliverable: PR with successful npm run build, lint green, and verified dev/prod builds.

- Phase 2 – Frontend Quality & Cleanup (20 h)

Standardize Composition API and props/emits.

Centralize Axios with interceptors (auth, error handling).

Remove hardcoded or redundant logic.
Deliverable: PR deployed; no console warnings; HTTP layer unified.

- Phase 3 – Architecture & Modularization (18 h)

Reorganize app by features (auth, listings, auctions, payments).

Implement Pinia for global state.

Add Laravel Form Requests for validation.
Deliverable: PR with verified modular folder structure and working states.

-Phase 4 – App & Payment Security (16 h)

Strengthen backend validation and CSRF/XSS protection.

Review and enforce guards/policies.

Add Stripe webhook verification and idempotency.

Run composer/npm audit.
Deliverable: PR approved after OWASP checklist passes; payment flow verified.

- Phase 5 – Logging & Error Handling (8 h)

Structured logging + rotation.

Integrate Sentry or Bugsnag (front + back).

Add safe 4xx/5xx pages.
Deliverable: PR verified; Sentry logs visible and anonymized.

- Phase 6 – Testing (18 h)

Add PHPUnit, Vitest/Jest, and Cypress/Playwright tests for core flows.
Deliverable: PR merged only after all tests pass in CI.

- Phase 7 – Performance & UX (12 h)

Code-splitting, lazy loading, image optimization.

Eager loading and caching for backend.
Deliverable: PR with measurable improvement (Lighthouse + DB queries).

- Phase 8 – CI/CD & Repo Governance (8 h)

Set up GitHub Actions (lint + test + build + audit).

Branch protection, CODEOWNERS, Dependabot.

Update README, CONTRIBUTING, and release checklist.
Deliverable: PR approved; CI pipeline green and documentation complete.

- Total Time: 126 hours (maximum, strictly capped)

No extra hours will be approved under any circumstances.

Final delivery deadline: October 31st, 2025.
All milestones must be delivered and approved before this date.

-Payment & Penalty Policy

Late delivery penalty: 20% deduction per day of delay after the final deadline (31 Oct 2025).

Each milestone is paid only after:

1. Code is merged, reviewed and approved on GitHub.

2. The feature works correctly on the staging server.

3. Checklist is signed off by the project owner.

- Developer Requirements

4+ years professional experience in Laravel 9/10 and Vue 3.

Strong expertise in CSP, HSTS, rate-limiting, OWASP standards.

CI/CD experience (GitHub Actions or GitLab CI).

Stripe Connect & webhook security experience.

Clean, modular, test-driven code discipline.

Professional communication and milestone-based delivery.

- Communication & Validation

All communication and payments must remain inside Freelancer.com.

Daily progress updates required.

Each phase must include:

GitHub PR for code review.

Functional validation on staging.

Documented milestone checklist confirmation.

- Goal: Deliver a production-ready, fully secure, modular, and high-performance Laravel + Vue 3 platform with full code auditability and long-term scalability