Full Stack Engineer to audit and harden an AI-built Next.js + Node app for production

We've built a rental listings web app. The web app (Next.js) and the backend API (Node/Express) were built largely with AI coding tools. The features work, but the code needs an experienced engineer to review it and make it production-ready before launch. This is not a build-from-scratch job. You'll audit the existing code, report what's risky, and fix the most important issues. *Tech stack* - Frontend: Next.js 14 (App Router), TypeScript, Tailwind CSS - Backend: Node.js, Express, TypeScript, Zod - Supabase: Postgres, Auth (Google OAuth and email), Storage, Row Level Security - Sharp for image processing; Vercel for the web app - Separate repos for web and API *What's built* - Landing page; listings search with filters and SEO routes; property detail with contact-owner reveal - Google and email authentication, with renter and landlord roles - Five-step property listing form with photo upload - Landlord dashboard (listings, leads, saved properties, profile) - REST API for all of the above, plus a listing auto-expiry job *Scope* Phase 1: Audit (deliver a written report) Review both repos and produce a prioritised list of issues (critical, high, medium), covering: - Security: Supabase RLS policies, auth middleware and JWT verification, authorization on every landlord endpoint, input validation, secrets and environment handling, CORS, rate limiting on auth and contact reveal - Data integrity: schema, constraints, indexes for search queries, migrations - Error handling and logging on the API - Next.js: server/client component boundaries, caching, SEO metadata, image optimisation, and anything broken in production builds - Dead code, duplicated logic, and inconsistent patterns typical of AI-generated code Phase 2: Fix Fix every critical issue and as many high-priority issues as the budget allows, in order of priority. Document anything you don't get to. Phase 3: Production readiness - Make sure both apps build and deploy cleanly, with production environment configs - Add basic error monitoring (e.g. Sentry) and health checks on the API - Write a short launch checklist with remaining risks *What we're looking for* - Senior-level full stack experience with Next.js and Node/Express in production - Strong Supabase knowledge, especially RLS and Auth - A security-minded reviewer who can judge what really matters before launch versus what can wait *Use of AI tools* We encourage using AI-assisted tools like Claude Code, Cursor, or Copilot. The codebase was built with them, and using them well will help you move faster within the budget. That said, AI output needs careful checking, and that's exactly why we're hiring a human expert: - You must understand and review every change you submit. Don't merge AI-generated fixes you haven't verified. - Test security and auth changes manually, not just by trusting the generated code. - Each PR description should explain what changed and why, in your own words. - Tell us which tools you use and how you use them in your workflow. *Deliverables* - Audit report (Markdown or Google Doc) - Fixes as pull requests with clear descriptions - Launch checklist and a list of remaining issues *Budget and engagement* - $500 fixed, in two milestones: $150 for the audit report, $350 for the fixes and production-readiness work - Expected effort: about 20–30 hours - Timeline: 1–2 weeks *To apply, answer these:* 1. Describe a codebase you've audited or hardened for production. What were the most serious issues you found? 2. In a Supabase + Express app, what are the first three things you'd check for security? 3. Have you worked with Supabase RLS and Auth in production? 4. Your availability over the next two weeks. 5. Which AI coding tools do you use, and how do you check their output before shipping it? Start your proposal with the word "Verified" so we know you read this far.