Security and Architecture Reviewer

Role Overview

Review and help secure a live operations platform for a car rental agency operating across the Middle East and Europe. The platform uses React/Vite, Supabase, and Vercel, integrates with the N-Genius payment gateway, and stores customer personal data subject to UAE PDPL. The initial work focuses on security, data protection, architecture, reliability, payments, and operational readiness. Further support may include production issue response, system hardening, and scoped feature work.

Responsibilities

• Review authentication and session handling, access controls, Supabase row-level security across tables, exposed keys and secrets, API and edge-function permissions, and storage access rules.
• Assess where personal data is stored, who can access it, whether deletion works as expected, and gaps against UAE PDPL basics.
• Evaluate architecture and reliability, including likely failure points, error handling, backups, and existing monitoring and alerts.
• Review payment flows to confirm card data does not pass through the platform, payment callbacks are verified, and failed or duplicate payments are handled.
• Recommend monitoring, alerting, and an appropriate on-call routine.
• After the review, help address production issues and harden systems through agreed, job-based work; quote new features and builds separately.
• Document changes clearly in writing and work in the client’s GitHub, Vercel, and Supabase accounts as a collaborator.

Required Skills

• At least 4 years of experience building and operating production web applications.
• Strong React and TypeScript skills, plus experience with Supabase and Postgres, including authentication, row-level security, and edge functions.
• Experience deploying applications on Vercel.
• Practical security experience covering authentication, access control, secrets handling, and data protection, such as GDPR, UAE PDPL, or similar requirements.
• Experience with payment-gateway integrations or webhooks.
• Clear written English and responsive communication during working hours.
• Working hours that overlap with Melbourne (AEDT) or Dubai (GST).

Nice to Have

• Experience with Make.com or n8n automations.
• Experience building dashboards or reporting features.
• Comfort working alongside a non-technical founder who builds prototypes using AI tools.
• Familiarity with operational platforms involving data imports, user roles, audit logs, payment-link automation, or planned modules such as portals, email sequences, and WhatsApp assistants.