Technical Due Diligence Audit for Legacy Symfony SaaS

## Job description I’m evaluating the acquisition of an established SaaS and need an independent technical due diligence review before closing. The platform is currently live with paying customers. I am **not** looking for a full rewrite or immediate modernization. The goal is to determine whether the current system can operate safely for approximately another 12 months after targeted stabilization, and to identify what must be fixed before or shortly after the acquisition. ### Current stack * Symfony 3.4 main backend * Two Symfony 4.1 image services * PHP and MySQL * React and Redux web application * Next.js e-commerce/marketing site * GitLab CI/CD * DigitalOcean, Nginx and PM2 * Stripe billing * Image storage and CDN delivery * PDF generation and FFmpeg video rendering There are five private GitLab repositories available for review. ### Initial scope The first milestone will be capped at **15 hours**. Additional hours must be approved in advance. The reviewer should: * Review the structure and maintainability of all five repositories * Attempt to reproduce the applications in a clean local environment * Confirm required PHP, Node.js, Composer, MySQL and system dependencies * Identify known vulnerable, abandoned or incompatible dependencies * Review the code for exposed credentials or secrets * Assess authentication, permissions and Stripe webhook handling * Review image uploads, PDF exports and FFmpeg video rendering * Investigate any obvious syntax errors or production-code inconsistencies * Review the current GitLab deployment process * Determine what information is needed to verify the exact code running in production * Review the current backup setup and recommend a safe restore test * Estimate the work required to stabilize the platform No production changes or disruptive testing should be performed without written approval. ### Required deliverable Please provide a written report separating findings into: 1. Critical issues that should be resolved before closing 2. Stabilization work required during the first 30 days 3. Work that can safely wait 6–12 months 4. Optional long-term modernization 5. Estimated hours and cost for each item The report should directly answer: * Can the platform safely operate for another year after limited stabilization? * Can the applications be reproduced from the repositories? * Are there any known critical security risks? * Can the current backup process realistically recover the business? * Is upgrading Symfony practical, and are there any major blockers? * What is the likely cost of the immediate stabilization work? ### Ideal experience Please apply only if you have hands-on experience with: * Legacy Symfony and PHP applications * Symfony version upgrades * Linux, Nginx and production servers * MySQL * DigitalOcean or similar cloud infrastructure * SaaS security and dependency reviews * Backup restoration and deployment planning Experience reviewing software for an acquisition is helpful but not required. The repositories and all business information are confidential and may not be published, reused or uploaded to public services. In your proposal, briefly describe a legacy Symfony or PHP application you reviewed or upgraded, the main risks you found, and how you estimated the work before making production changes.