We have Android/iOS apps (Expo React Native) pointing to the wrong server, with a suspected backdoor and static categories/banners. Connect both apps to our WordPress/WooCommerce backend, remove hidden controls, and make content fully dynamic. Scope (must-do): Repoint all API/base URLs to our server; remove any backdoors/hardcoded creds. Use .env + .env.example for config. Make categories/products/home banners load from WooCommerce (no rebuild needed) with basic caching/pagination. Deliver store-ready builds: Android AAB, iOS TestFlight/IPA with unique IDs/signing. Provide short audit (what changed/removed) + endpoint list and a README to build from scratch. Acceptance: No hardcoded URLs/secrets. WP changes (cats/banners) appear after refresh. Builds run on devices and pull data from our server. README + .env.example included. Milestones & Payment (release on accept): M1 (20%) Audit plan + .env wired + dev APK. M2 (35%) Repointing + dynamic data + backdoor removal. M3 (25%) Store-ready builds (AAB/IPA). M4 (20%) Final source + docs; 2-week bug-fix window. Note: Payments are milestone-based only after acceptance.