Developer Security & Reliability Review Next.js Postgres

We're three people building a web app that agencies will run their entire operation on: their projects, their team, their clients' data, their financials. We love building it and we're not giving that up. What we need is someone senior standing next to us, telling us the truth.

The app looks great and works well. Anyone can do that now. The part that actually matters, and that most teams shipping this way skip, is security, reliability, and compliance. Companies are going to trust us with everything they have. We're going to do this right or not at all.

We also don't know what we don't know. Our production readiness checklist isn't perfect, and we've already done things in development that we shouldn't have. We'd rather hear that from you than from a customer.

WHAT YOU'D ACTUALLY DO

* Two calls a week plus async reviews in between
* Review the codebase and our production-readiness checklist, then tell us what matters first, what can wait, and where we're wrong
* Review pull requests before they reach master and block the ones that shouldn't ship
* Review the instructions and guardrails we hand to our AI tools
* Sign off on when it's safe to put paying customers on the platform

WHAT'S IN FRONT OF US (or so we think)

Tenant isolation, secrets handling, rate limiting, auth hardening, backups and a real restore drill, audit trails, error tracking, uptime monitoring, branch protection, and a sensible path to compliance later. Security and reliability are priority one. Compliance (GDPR, SOC 2) is a real priority, but third.

STACK

Next.js (App Router), TypeScript, PostgreSQL on Supabase, Prisma, Auth.js, Vercel.

YOU

* 3+ years shipping and operating production web apps holding data that would hurt real people if it leaked
* You've hardened an app with real users, run a pen test or fixed what one found, and been the one who got paged
* Direct. You say "this is not okay" and mean it, and you can explain why to a non-developer without talking down
* Comfortable guiding people who build with AI: no contempt for it, no blind faith in it either
* Bonus: compliance work (GDPR, HIPAA, ISO 27001, SOC 2), DevOps and infrastructure

US

3 misfits with five years building operating systems for agencies on other people's platforms (Airtable and SmartSuite), now building our own. We've won together, and walked through fire together. We don't expect you to be here forever, but we'd love to grow with you while you are. You get what you give here!

DETAILS

* Part-time, starting at roughly 5–15 hours a week, hourly
* Fully remote, async-friendly, weekends are fine if that's when you do your best work
* Long-term if it's working for both of us

TO APPLY

Skip the template. Tell us two things: (1) the first three things you'd check before letting a Next.js + Postgres app hold customers' financial data, and (2) the scariest thing you've ever found in production and what you did about it.

Thank you!