There is a whole industry of people in India/Pakistan that do this. Their recommendations are pretty straight forward and usually based on basic vulnerability

There is a whole industry of people in India/Pakistan that do this. Their recommendations are pretty straight forward and usually based on basic vulnerability scanners and password best practices. It is very likely you can figure out your issue yourself, it is likely very obvious. I believe that this user is likely correct that there is a vulnerability and I would suspect it is a fairly straight forward one and you'll think it wasn't worth even $250. Here is a list of open source vulnerability scanners: https://resources.infosecinstitute.com/14-popular-web-application-vulnerability-scanners/ https://resources.infosecinstitute.com/14-popular-web-applic... And check your password practices, your headers to prevents XSS/iframing, and get your SSL certificate checked via an online tool. Also check the version numbers of your web server, jQuery, etc to ensure that you are not using one that has a security issue. The guy you are dealing with is not sophisticated, just looking for a quick buck doing something simple you are not doing.