FULL-STACK DEVELOPER – LEGAL PROFESSIONALS CONTACT PLATFORM

FULL-STACK DEVELOPER – LEGAL PROFESSIONALS CONTACT PLATFORM Project Description: Build a contact platform where visitors can search for legal professionals, view profiles, and send inquiries. The legal professionals must be able to update their own selected profile information without a user account. Existing Tools: - Domain - Hostup.se web hosting - Storage via Hostup.se - Sitejet / Sitepad - PHP/MySQL - Softaculous - cPanel Use Hostup.se and free/open-source components where practical. Technical Requirements: - PHP/MySQL or equivalent - Hostup.se - Open-source code where practical - Simple architecture - Responsive design for Android, iOS, and desktop - Complete source code delivered to the client Security, GDPR, and Spam Protection: 1. Admin panel protected by appropriate authentication. 2. HTTPS/TLS for all communication. 3. Protection against SQL injection, XSS, CSRF, and unauthorized access, following relevant OWASP guidance. 4. Inquiry data protected against unauthorized access. 5. Spam protection using CAPTCHA, honeypot, rate limiting, or equivalent. 6. GDPR requirements for data minimization, storage limitation, deletion, and security must be supported. Security Testing: Before delivery, the application must undergo web-application security testing based on recognized industry practices, preferably relevant OWASP WSTG and/or ASVS requirements. Testing must cover: - Authentication and authorization - Access control - Session/token security - SQL injection - XSS - CSRF - Sensitive-data exposure - Security misconfiguration - Brute-force/token-guessing resistance - Unauthorized access to other legal professionals' data - Unauthorized access to administration functions A penetration test or equivalent platform security assessment must be completed before final acceptance. A security-testing report must be provided. No unresolved critical or high-risk security vulnerabilities may remain at final acceptance. Functional Requirements: 1. Legal Professionals Database Fields: - Name - Firm - Region - City - Contact information - Website - Practice areas - Hourly rate - Payment terms - Languages - Remote meetings - Legal expenses insurance - Legal aid - Accepting new clients: Yes/No/Limited - Bio 2. Search and Filtering Filter by: - Region - City - Practice area - Languages - Hourly rate - Remote meetings - Legal expenses insurance - Legal aid - Accepting new clients 3. Profile Page Display: - Name/firm - Region - City - Practice areas - Hourly rate - Remote meetings - Payment terms - Languages - Accepting new clients - Bio Include a "Send Inquiry" button. 4. Inquiry Form Collect: - Name - Email - Phone - Message - Matter type Options: - Remote meeting - Legal expenses insurance - Legal aid No visitor login is required. The inquiry must be sent to the legal professional and stored securely in the database. 5. Legal Professionals' Self-Service Each legal professional receives a unique, cryptographically random update token. The update link must allow the legal professional to change: - Accepting new clients: Yes/No/Limited - Hourly rate - Bio The token must: - Be unpredictable and sufficiently long - Not rely on a sequential ID - Only provide access to that legal professional's own editable data - Not provide admin access - Be protected against guessing/brute force - Be revocable - Be replaceable with a new token The developer must describe the token implementation in the offer. 6. Email When an inquiry is submitted, the legal professional receives: - Subject: CLIENT INQUIRY - Inquiry information - Platform information - Personal update link The visitor receives an automatic confirmation email. 7. Administration The admin panel must allow: - Add/edit/remove legal professionals - Publish/unpublish profiles - Edit practice areas and locations - Generate/resend update links - Revoke/replace update links 8. Website - Website search - Practice area, region, and city filters - Responsive design - User-friendly interface 9. Out of Scope - Mobile app - CRM - Consumer accounts - Legal professionals' accounts/password login - Chat - Payments - Booking - Advanced analytics - AI - Automatic matching The secure legal professionals' update link is included. Testing and Acceptance: Test: - Adding/removing legal professionals - Publishing/unpublishing - Search/filtering - Profiles - Self-service updates - Availability changes - Rate changes - Bio changes - Token generation/replacement/revocation - Inquiry submission - Spam protection - Email delivery - Android, iOS, and desktop Security testing must also verify that update tokens cannot be used to: - Guess/access another professional - Modify another professional's data - Access admin functions - Access inquiry data Critical and high-risk vulnerabilities must be resolved and retested before acceptance. Delivery: Provide: - Production-ready website - Complete source code - Database and database structure - Admin panel - Update-link system - Installation instructions - Configuration instructions - Security-testing report Payment and Acceptance: Payment is made after delivery and a two-week acceptance period. During this period, the client may test functionality, security, and compatibility. Final acceptance requires: 1. Required functionality delivered 2. Security testing completed 3. No unresolved critical or high-risk vulnerabilities 4. Material defects fixed and retested Payment will be made through Invozio, a freelance company. Budget: Low-budget, cost-effective. Use existing hosting and free/open-source components where practical. Application and Quote: Include: 1. Fixed price excluding VAT 2. Estimated delivery time 3. Technology stack 4. Similar projects 5. Hostup.se compatibility 6. Source-code delivery method 7. External costs 8. Technical solution 9. Testing approach 10. GDPR approach 11. Security measures 12. Spam protection 13. Update-token security 14. Security-testing methodology 15. Confirmation that security testing is included in the price 16. Hostup.se limitations Application: Send application and quotation to Zia Zenith: zia.zenith.llc@gmail.com