Security & Architecture Audit of Existing Full-Stack App

Hi! I'm looking for an experienced developer to do a security and architecture review of an existing production web app before launching a paid entry feature. The app: A live web platform (React/TypeScript, Express.js, PostgreSQL) with 1,000+ registered users in its first season. Built primarily with AI-assisted development (Replit Agent). Will be adding Stripe Checkout for paid entry and want a review before real payments go live. Timing: This engagement is planned for early 2027 — I'm reaching out now to find the right fit and line things up in advance, not to start immediately. Happy to discuss availability for that window. What I need: - Review of the new Stripe integration (to be built, webhooks, payment status tracking) - Review of core transaction/locking logic — the most complex and highest-risk part of the app - General security pass across auth, data access, and API routes - A written findings report, prioritized by severity. What this isn't: a rebuild or feature-build project. This is scoped as review-only; I have my own workflow for fixing whatever's found. How I work: clear async communication, happy to do a short call to align on scope first. I'd like this structured in two milestones — initial findings, then a full report. If interested, share your experience reviewing (not just building) production codebases, and a rough time/cost estimate for this scope.