Senior Python + Next.js engineer for a legal-tech SaaS

Senior Python + Next.js engineer for a legal-tech SaaS: portal logins, browser automation, court-site scraping **About Clerkist** Clerkist saves solo and small-firm criminal defense attorneys hours of admin work. It connects to a firm's email and cloud storage. It reads incoming court notices, puts hearing dates on the attorney's calendar and files discovery from prosecutors into the right client folder. We are a small team that ships often. **The work** The work is split into three fixed-price milestones, each paid on acceptance. We will start with the the first objective. 1. **Codebase review** We built much of the codebase quickly with heavy help from AI coding tools. We want an experienced engineer to review it and tell us what to fix. Deliver a written report covering security, reliability, architecture and gaps in test coverage. Rank each finding by severity, separate must-fix items from nice-to-haves, and point to the specific code. This milestone involves no code changes. It is also how you learn the codebase before building anything. Each item should have a LOE estimate as well. Depending on the item, severity, and LOE, addressing it may be included in the scope of this contract if agreed by all parties. 2. **Saved logins for password-protected discovery links** Some prosecutor offices share discovery through file-sharing portals that require a login. Users should be able to save a username and password for a site in Clerkist's settings. When a discovery link points to that site, Clerkist signs in automatically, downloads the files and files them. Passwords are encrypted at rest. They are never logged or returned to the browser after they are saved. Browser automation (we already use Playwright) handles common login forms, including two-step email-then-password flows. Some sites will need a small site-specific recipe. Multi-factor authentication and CAPTCHAs are out of scope. Those downloads are flagged for the user to handle by hand. Includes a settings page for adding, editing and removing saved logins, which will be respective of tenant and organization. 3. Court website calendar check Some courts have individual attorney calendars behind a password protected login page. Start with one specific court website, which we'll share after the NDA. Clerkist should check it on a schedule, find respective events and compare them with the calendar of the attorney and then take action on the diff. Build it so more courts can be added later. Each court should be a small adapter behind a shared interface, so adding one doesn't touch the matching logic. This feature should be respective of attorney and tenant, so cross contamination does not occur. Include a short write-up on what a second court would take. The scraper must fail loudly when the site's layout changes. It must never report "no hearings found" because a page failed to parse. Stack - Backend: Python 3.12, FastAPI, SQLAlchemy 2 (async) with asyncpg, PostgreSQL, Alembic, long-running asyncio background workers - Frontend: Next.js, React, TypeScript, Tailwind, shadcn/ui - Integrations: Gmail, Outlook (Microsoft Graph), Google Calendar, Dropbox, Stripe, Playwright - AI: Anthropic Claude API for structured extraction from OCR'd court PDFs - Infrastructure: Railway, Vercel, GitHub Actions **How we work** 1. We have about 2,000 fast unit tests. New code comes with tests. 2. Every pull request must pass CI: tests, lint, type-check, frontend build, a migration check against a fresh Postgres database, and secret and security scans. 3. Pull requests are reviewed and describe what changed and how it was verified. 4. AI coding tools are welcome, but you own the result and must be able to explain every line. **You're a fit if you have** 1. Shipped production async Python (FastAPI or similar) with SQLAlchemy and Postgres 2. Built browser automation that logs into real third-party sites and read information on that site, and kept it working when they changed 3. Handled secrets properly: encryption at rest, key management, keeping credentials out of logs 4. Enough React and TypeScript to build the UI for your own features alongside our previously built UI Bonus: security or code-review background, or legal-tech or other regulated-data experience **Confidentiality** We handle confidential attorney–client material, so an NDA is required before you get repository access. You will work against a staging environment only. Production data and production credentials are never shared, but we can review how things are behaving in production via calls. **To apply** 1. Describe a time you automated logins to a website you didn't control. How did you handle it when the site changed? 2. Describe a scraper you built against a site you didn't control. How did you detect when its layout changed? 3. Give a rough price and timeline for Milestone 1, the codebase review. Also say how you would approach it in the first two days. We skip generic proposals. Tell us your favorite book or movie in your response.