Security Remote · Europe Full-time · Contract (hourly)
Audit client SaaS products and vibe-coded apps by hand, and review our own products before they ship. Node.js and npm supply-chain security are home turf.
Apply for this roleAbout the role
AI coding tools let people ship in a weekend — along with exposed keys, open database rules, and API routes anyone can call. You'll audit those apps and established SaaS products, fix what you find alongside their builders, and make sure every product we build ourselves is secure before we sell it. What you learn feeds into our tooling, including DeployReady, our open-source scanner.
What you'll do
- Run hands-on security audits of SaaS products and apps built with Lovable, Bolt, Cursor, v0, and Replit
- Test auth, access control (including IDOR), Supabase/Firebase rules, and API routes
- Review npm dependencies and supply-chain risk in Node.js and JavaScript projects
- Assess AI features for prompt injection, data leakage, and over-permissioned tools
- Review Belsoft's own products and client platforms before release
- Write clear findings reports with exact fixes, then retest
- Turn recurring findings into automated checks in our tooling, including DeployReady
What you bring
- Strong JavaScript/TypeScript and Node.js
- Solid understanding of the OWASP Top 10 and web application security testing
- Experience reviewing npm packages, lockfiles, and dependency risk
- Ability to explain a vulnerability clearly to a non-security developer
- You've found and responsibly reported real security issues
Nice to have
- Experience with Supabase, Firebase, or other backend-as-a-service platforms
- Familiarity with Babel/AST tooling or static analysis
- LLM security experience, bug bounties, or security certifications
Apply
Sound like you?
Five minutes. No cover-letter theatre — just tell us what you've done and why this role.
