Legacy PHP Application Security Audit and Modernisation

A client's aging codebase had accumulated security vulnerabilities, outdated dependencies, and no automated testing. Conducted a full penetration test, identified 23 vulnerabilities (including SQL injection and XSS vectors), then systematically refactored the application with prepared statements, CSRF protection, input validation, and modern PHP 8+ features. Introduced PHPUnit tests and a CI pipeline to prevent regression.