Ongoing developer to maintain & harden a production HR platform

About the system I have a production HR platform — payroll, employee records, document and compliance tracking, vacations, recruiting, and an employee self-service portal — built in vanilla JavaScript + Firebase. No framework, no build step, by design: direct deploy. It serves ~150 employees in production, handling sensitive data so security and stability are the priority. The code is well documented, with comments that explain why each decision was made, and there's a set of "golden" test cases I run with node that must pass before any change ships. The role — main focus: code quality and security An ongoing developer to improve and harden the existing system. I'm open to evolving it — I just can't put a live system at risk. It runs payroll for ~150 real people every week, so improvements have to be made safely, incrementally, and without disrupting operations. Core responsibilities: Security: close known vulnerabilities, keep dependencies patched, review the client/server trust boundary, add integrity checks, audit the Firebase security rules Code quality: refactor and clean up as we work — proving behavior is unchanged with the golden tests, and keeping the decision comments intact Fix bugs and build new modules in the same stack I'm not against modernizing where it genuinely helps. What I won't do is rewrite a working payroll system just to modernize it — a change has to earn its place by making the system safer or better, not just newer. Any change ships only when the golden tests pass identically before and after. What I'd like from you first Before any coding, I want to see how you think. I'll walk you through the product and share the code. Tell me: Your read on how it's built and its security posture Your proposed plan for improving code quality and security over time — safely, on a system that stays in production Any specific risks or opportunities you notice If we click, this becomes an ongoing part-time role, around 20 hours per week.