Quality Node/React/Postgres Web App Code Review
Budget / Salary$250–750
TypeFreelance project
LocationRemote
Posted1 day ago
Project title: Independent human code review of a Node/React/Postgres web app (auth, permissions, API, data layer)
Skills: Node.js, Express, PostgreSQL, React, Security Review, Code Review
Description
I’m looking for an experienced software engineer to do an independent review of a web application before it goes live with its first real users. This is a quality review of the critical paths. It is not a security pen test or a certification.
AI reviews are already done. I need a human.
The codebase has already been through a series of AI-assisted, read-only reviews covering structure, security, maintainability, database, performance, and UI. Those findings are being worked through. What I need now is an experienced human engineer’s judgment: confirm what matters, catch what automated review missed. I’d like you to form your own view of the code first before you run the code through AI so you aren’t anchored to AI findings.
The application
It’s a multi-role web platform (four user roles) for vocational training, now in a small pilot.
Frontend: React 19, Vite, React Router, Tailwind
Backend: Node.js and Express, with PostgreSQL through the pg driver (raw SQL, forward-only migrations)
Validation: Zod at the API boundary
Auth and email: Clerk for auth, Resend for email
Hosting: managed hosting (Railway and Vercel)
Size: about 170 API routes, with a large existing test suite
Access: you’ll get read access to a private GitHub repo
What to review
Authentication. Sign-in, session handling, invitation and onboarding flows.
Authorization and permissions. Can each role reach only what it should? Look for cross-tenant or cross-user data access, privilege escalation, and missing server-side checks.
API contracts. Input validation, error handling, consistent responses, and failure behavior (including partial writes and transactions).
Data layer. Schema and constraints, migrations, transaction correctness, integrity of records that must not be lost or altered, and delete behavior.
Architecture match. Does the implementation match the documented architecture? Project docs are in the repo.
Deliverable
A written list of issues to fix, grouped by priority:
Critical: must be fixed before real users touch the system. Data exposure, privilege escalation, loss or corruption of records.
High: a real defect or risk that should be fixed before launch.
Medium: a correctness or maintainability issue to fix soon.
Low: minor issues, hygiene, and suggestions.
For Critical and High priority items, give the file and line, what’s wrong, why it matters, and a suggested fix. Close with a short paragraph on whether the code matches its documented architecture and where it differs.
Out of scope
Penetration testing, load testing, and compliance or certification work (SOC 2 and similar)
Full accessibility audit
UI and visual design review
Rewriting code
Requirements
NDA. You must sign a confidentiality agreement before you get repo access.
No conflict of interest. You must have no business or personal relationship with the parties involved.
Experience. Production experience with Node/Express and PostgreSQL, and a track record of reviewing auth and permission logic.
In your bid, please include
A review you’ve done before, or the kind of issue you typically catch that automated tools miss.
Your experience with role-based authorization in multi-tenant apps.
Your estimated turnaround.
Skills: Node.js, Express, PostgreSQL, React, Security Review, Code Review
Description
I’m looking for an experienced software engineer to do an independent review of a web application before it goes live with its first real users. This is a quality review of the critical paths. It is not a security pen test or a certification.
AI reviews are already done. I need a human.
The codebase has already been through a series of AI-assisted, read-only reviews covering structure, security, maintainability, database, performance, and UI. Those findings are being worked through. What I need now is an experienced human engineer’s judgment: confirm what matters, catch what automated review missed. I’d like you to form your own view of the code first before you run the code through AI so you aren’t anchored to AI findings.
The application
It’s a multi-role web platform (four user roles) for vocational training, now in a small pilot.
Frontend: React 19, Vite, React Router, Tailwind
Backend: Node.js and Express, with PostgreSQL through the pg driver (raw SQL, forward-only migrations)
Validation: Zod at the API boundary
Auth and email: Clerk for auth, Resend for email
Hosting: managed hosting (Railway and Vercel)
Size: about 170 API routes, with a large existing test suite
Access: you’ll get read access to a private GitHub repo
What to review
Authentication. Sign-in, session handling, invitation and onboarding flows.
Authorization and permissions. Can each role reach only what it should? Look for cross-tenant or cross-user data access, privilege escalation, and missing server-side checks.
API contracts. Input validation, error handling, consistent responses, and failure behavior (including partial writes and transactions).
Data layer. Schema and constraints, migrations, transaction correctness, integrity of records that must not be lost or altered, and delete behavior.
Architecture match. Does the implementation match the documented architecture? Project docs are in the repo.
Deliverable
A written list of issues to fix, grouped by priority:
Critical: must be fixed before real users touch the system. Data exposure, privilege escalation, loss or corruption of records.
High: a real defect or risk that should be fixed before launch.
Medium: a correctness or maintainability issue to fix soon.
Low: minor issues, hygiene, and suggestions.
For Critical and High priority items, give the file and line, what’s wrong, why it matters, and a suggested fix. Close with a short paragraph on whether the code matches its documented architecture and where it differs.
Out of scope
Penetration testing, load testing, and compliance or certification work (SOC 2 and similar)
Full accessibility audit
UI and visual design review
Rewriting code
Requirements
NDA. You must sign a confidentiality agreement before you get repo access.
No conflict of interest. You must have no business or personal relationship with the parties involved.
Experience. Production experience with Node/Express and PostgreSQL, and a track record of reviewing auth and permission logic.
In your bid, please include
A review you’ve done before, or the kind of issue you typically catch that automated tools miss.
Your experience with role-based authorization in multi-tenant apps.
Your estimated turnaround.
Apply on Freelancer →
Project sourced from Freelancer.com. Applications happen directly on the original platform — we never collect your data.