Penetration Tester — Web App + Supabase Backend (SaaS Recruiting Platform)
Penetration Tester — Web App + Supabase Backend (SaaS Recruiting Platform) Client: ThunderJaws Human Resources Solutions Project: Hire.ThunderJaws.com (production SaaS) Engagement: Fixed-price, ~3 weeks active testing + 30-day retest window Budget range: TBD ________________________________________ About the project ThunderJaws is a live recruiting marketplace (job seekers, employers, admin) with: •React + Vite frontend
- Supabase backend (Postgres + RLS, Auth, ~40+ Edge Functions, Storage)
- Stripe billing (Pro tier $199/mo, employer resume unlocks)
- WebAuthn passkeys + TOTP MFA
- Resend transactional email
- Public job-feed endpoint with per-partner UTM tracking
We need a qualified, independent penetration tester to validate the platform end-to-end before scaling paid employer features. ________________________________________ What we're looking for (Step 1 — Initial Review) Apply with a short proposal (1 page max) covering: 1. Your background — years pen-testing, certifications (OSCP / OSWE / GWAPT / CREST / Burp Suite Certified, etc.), and confirmation you are an independent firm or individual (not reselling automated scanners). 2. Relevant experience — at least one prior engagement on a multi-tenant SaaS with Supabase, Postgres RLS, or similar row-level authorization model. 3. One redacted prior pen-test report (PDF) demonstrating manual testing depth — not a Nessus/Burp scan dump. 4. Liability insurance — confirmation of ≥ $1M professional liability coverage. 5. Approach to third-party validation — how you will independently verify that employer-paid resumes are actually delivered to and processed by third parties (ATS webhooks, email deliverability with DMARC/DKIM/SPF, job-board apply receipts, or customer attestation). Google crawlers, Lighthouse, and generic SaaS scanners do NOT qualify — this is a hard requirement. ________________________________________ What we are NOT looking for
- Automated-scanner-only deliverables
- Agencies subcontracting to unvetted offshore testers
- Anyone unfamiliar with Supabase RLS, Edge Functions, or JWT-based auth
- "Pass/fail" checklists without proof of exploitation or remediation guidance
________________________________________ Next step Selected candidates will receive the full Scope of Work (Step 2) under NDA, including:
- Detailed in-scope / out-of-scope asset list
- Acceptance criteria (including the third-party resume validation chain)
- Deliverables, milestone payment schedule, and retest terms
- Source-code access on request
- Test accounts (job seeker, employer, admin)
________________________________________ To apply: Send the 6 items above. Shortlisted candidates will be contacted within 5 business days to receive the full SOW. Independent firms preferred. Recommended profiles: NCC Group, Bishop Fox, Cure53, Trail of Bits caliber — or equivalent independent practitioners.