Independent code review of a Node.js and Google Cloud web app (registration and payments)

Indy Genesis is a youth homeschool sports nonprofit in Indianapolis serving about 650 athletes. Our contract developer is building a registration and payments app for our families, and phase 1 goes live this month. We want an independent developer to review the code and how our cloud accounts are set up. We want to know whether the app is solid, whether our families’ data and payments are safe, and whether another developer could take it over. This is a review only: you won’t change code or production settings. The app and its services: * Node.js 22 and Express on Google Cloud Run; Cloud * Scheduler for timed jobs (payment-plan charges); Secret Manager for keys * Firestore database; nightly data export to Cloud Storage * Plain JavaScript web app (a PWA with no framework) on Firebase Hosting * Stripe payments with webhooks, including saved cards for payment plans and refunds * Twilio for text sign-in codes; Google Workspace APIs (Gmail sending, Groups, Calendar); Google Maps; Microsoft Clarity session recording * Automated tests that run before every server deploy; README, runbook and decisions document Access you’ll get (read-only): GitHub repository; Google Cloud / Firebase project (Viewer and Security Reviewer roles); Stripe (read-only); screenshots or read access for Twilio, Workspace permissions and Clarity as needed. You’ll work with test data and Stripe test mode only, never production family data, and you’ll sign a short confidentiality agreement. Please don’t put any of our data into AI tools. What we’d like you to assess: 1. Takeover: Following only the README and runbook, set the app up in a separate sandbox Google Cloud project (we’ll provide it) with Stripe test mode, and run the test suite. What worked, what didn’t, and how long would it take a new developer to support this app? 2. Code quality: Is it organized, readable and documented well enough for someone else to maintain? Is the no-framework front end structured in a way that will hold up as the app grows? 3. Security and privacy: sign-in (code expiry, rate limiting, sessions); permissions (a parent sees only their family, a sport board sees only its sport); Firestore security rules; secrets handling and git history; known vulnerabilities in third-party packages; personal data kept out of logs and Clarity; encryption and access logging for hardship-aid answers. 4. Payments: webhook verification, protection against double charges, payment-plan retries and failures, refunds, and reconciliation records. 5. Cloud setup: who has what access in Google Cloud, Firebase, Stripe and GitHub; Workspace permissions limited to what’s needed; backups on, and whether a restore has been tested; monitoring and budget alerts. 6. Ownership: confirm everything runs in accounts Indy Genesis owns, with nothing depending on the developer’s personal accounts or keys, and that all open-source licenses are fine for us to use. 7. Tests: do they cover what matters (payments, permissions, discounts, refunds)? What important areas aren’t tested? Deliverables: A written report in plain language that a non-programmer on our board can follow, with a one-page summary at the top An overall verdict: Ready / Ready after specific fixes / Not ready Findings rated Critical, High, Medium or Low, each with a recommended fix and rough effort A 45–60 minute video call to walk us through it Optional: a short re-check after our developer makes the fixes We’re not looking for perfect code or style preferences. We want to know the app is solid and that we’re not stuck if our developer is ever unavailable. Timeline: Report due within 10 business days of receiving access. Independence: You must have no business connection to our current developer (Allen App Tools, LLC). You may send our developer clarifying questions through us. Skills: Node.js, Express, Google Cloud Run, Firestore and Firebase security rules, Google Cloud permissions, Stripe API and webhooks, JavaScript, web application security. Experience with Twilio and Google Workspace APIs is a plus. In your proposal, please include: * A time you took over a codebase another developer built, and what you found * A redacted sample of a past code or security review report * Your experience with Stripe payments and web app security