I built and operate a 106k+ LOC production SaaS on Next.js 15, Supabase and Stripe — solo. Zero "any" types in the whole codebase, 743 passing tests.
What I'm actually good at is the part that breaks after launch: the webhook replay, the downgrade that never revokes access, the export gated only in the browser, the URL fetch that can reach your metadata endpoint. I've put my own codebase through repeated adversarial audits and can share a redacted report — real findings, real severities, subject anonymised.
Available ~20-30 hrs/week, UTC+0 — good overlap with European hours and US mornings. Contract or fixed-scope. I also do fixed-price pre-launch audits (security, billing correctness, data exposure) if that's more useful than hourly.
Orangecat2026 · · focus · HN ↗
I built and operate a 106k+ LOC production SaaS on Next.js 15, Supabase and Stripe — solo. Zero "any" types in the whole codebase, 743 passing tests.
What I'm actually good at is the part that breaks after launch: the webhook replay, the downgrade that never revokes access, the export gated only in the browser, the URL fetch that can reach your metadata endpoint. I've put my own codebase through repeated adversarial audits and can share a redacted report — real findings, real severities, subject anonymised.
Available ~20-30 hrs/week, UTC+0 — good overlap with European hours and US mornings. Contract or fixed-scope. I also do fixed-price pre-launch audits (security, billing correctness, data exposure) if that's more useful than hourly.