Available for remote roles
Iqtidar Hadi
Full Stack Developer
I design and ship secure Laravel, Python and React products — then test them the way an attacker would. Clear architecture, OWASP-based assessments, and responsible disclosure.
Services
What I deliver
From building the product to assessing it safely — so releases stay reliable and secure.
Build
Secure web applications
Laravel, Livewire and React systems with authentication, roles, and maintainable architecture.
Integrate
API design & integrations
REST APIs for web and mobile, payment gateways, logistics partners, and third-party services.
Assess
Web & API security testing
OWASP-aligned review of auth, access control, input handling, and business logic — with written permission only.
Automate
Python tooling
Scripts for repeatable testing, data processing, reporting, and operational workflows.
Experience
Professional experience
Backend delivery across SaaS, commerce, and public-sector systems.
Laravel Developer Current
- Build Laravel 10/11 applications with Livewire, React, JavaScript and AJAX.
- Design secure REST APIs with Sanctum, Passport and JWT under least privilege.
- Apply secure coding practices against injection, XSS, CSRF and broken authentication.
- Optimize MySQL queries and schema — reducing key load times by about 40%.
- Python automation and security scripts; Git-based deploys on VPS / cPanel.
Software Engineer
- Shipped SaaS inventory modules and Trade-in / Buyback product flows.
- Integrated payment gateways and logistics APIs into production checkout paths.
Web Application Developer
- Designed, built and deployed the Mercy Petition System for the Inspector General of Police within six months.
Web Developer
- Delivered responsive web applications and CMS sites; maintained production codebases.
Portfolio
Selected projects
Work I can walk through end to end — architecture, data model, auth, and impact.
Operations
RTS Dashboard
Real-time KPI and exception monitoring with role-based views, filterable history and fast-refresh queries.
Collaboration
Project Management System
Projects, milestones, tasks, status workflows and notifications — replacing scattered spreadsheets.
Public sector
Mercy Petition System
Government case intake, routing and role-based processing for the Inspector General of Police, Pakistan.
Commerce
Trade-in & Buyback
Purchase → refurbish → resell lifecycle that improved partner intake and revenue recovery.
Security
Python Security Tooling
Scripts for API testing, repeatable web assessment tasks, data processing and structured reporting.
Frontend
React & Livewire Apps
Reactive, permission-aware interfaces connected to secure Laravel backends.
Security tester
Web & API security testing
Authorized testing only. I assess systems I own or have written permission to test, then report findings so they get fixed.
Auth
Authentication & sessions
Login flows, password reset, token expiry, session fixation, brute-force protection.
Access
Authorization & IDOR
Role boundaries, object-level checks, privilege escalation, horizontal and vertical access.
Input
Injection & XSS
SQL injection, stored/reflected XSS, output encoding, file upload validation.
API
REST API security
Mass assignment, excessive data exposure, rate limiting, token handling, CORS.
Logic
Business logic
Payment and workflow abuse, race conditions, step skipping, price tampering.
Config
Misconfiguration
Security headers, TLS, debug exposure, directory listing, leaked secrets.
OWASP Top 10 — test vs fix
| Risk | What I test | Recommended fix (Laravel) |
|---|---|---|
| A01 Access Control | IDOR, forced browsing | Policies / Gates, scoped queries |
| A02 Crypto Failures | Weak hashing, plaintext secrets | Bcrypt / Argon2, HTTPS, env secrets |
| A03 Injection | SQLi, XSS, command injection | Eloquent bindings, Blade escaping, CSP |
| A05 Misconfiguration | Debug on, missing headers | APP_DEBUG=false, hardened headers |
| A06 Vulnerable Components | Outdated packages | composer / npm audit, update cadence |
| A07 Auth Failures | Brute force, weak sessions | Throttling, MFA-ready flows, token rotation |
| A09 Logging Failures | No audit trail | Structured logs, alerts, no secrets in logs |
Testing workflow
Scope & permission
Written authorization, defined targets and rules of engagement.
Recon & mapping
Routes, roles, inputs and trust boundaries.
Test & verify
Manual testing plus tooling; confirm with a minimal proof of concept.
Report & retest
Severity, reproduction steps, impact, fix guidance — then retest.
Sample finding format
FINDING Broken object-level authorization on /api/invoices/{id} [ HIGH ] IMPACT Any logged-in user can read another user's invoice by changing the ID. STEPS 1. Log in as User A 2. Request an invoice owned by User B 3. Data is returned FIX $this->authorize('view', $invoice); // Laravel policy check RETEST Request now returns 403 Forbidden.
Interactive · local only
Password strength tester
Runs entirely in your browser. Nothing is stored or sent. Do not enter a real password you use elsewhere.
Waiting for input
Stack
Skills & tools
Backend
Frontend
Security
Auth & access
Delivery
Integrations
BSCS, Abdul Wali Khan University Mardan (2014–2019), CGPA 3.2/4.0 · English, Urdu, Pashto
FAQ
Common questions
Do you test systems without permission?
Never. I only test applications I own or have written authorization for, with agreed scope and rules.
What do you need to start a security test?
The target URL or API docs, test accounts for each role, a clear scope, and a contact for urgent findings.
What will I receive after testing?
A report with severity, steps to reproduce, impact and fix guidance, plus a retest once fixes are applied.
Are you available for remote work?
Yes. I work remotely with teams and clients, and I am based in Peshawar, Pakistan (PKT).
Contact
Let’s build something reliable.
Open to remote Full Stack, Laravel, Python and security testing roles — plus selective freelance work.
Message sent. Thank you — I will reply soon.