yaaberProvide independent, practical security and code review for agreed changes and high-risk flows. Scoped engagements include time for remediation review and retesting, with clear evidence and honest coverage limits.
5–8+ years. Scoped contract engagement.
Location: Hyderabad. Work-from-home arrangements may be considered and agreed later. Local candidates are preferred.
Yaaber is a mobile-first social product spanning content, live conversations, messaging, audio and video, group calls, reels and news, alongside the organisation Companion. This role works with the existing product and codebase.
Must have
- Hands-on JavaScript and TypeScript, API and serverless code review.
- Authentication, authorisation, session and token handling, and cross-user data isolation.
- Practical assessment of common OWASP risks, including IDOR, XSS, CSRF, SQL injection and SSRF where applicable.
- Clear, reproducible findings with severity, practical remediation advice and retest evidence.
Main responsibilities
- Independently review agreed changes and high-risk flows within expressly authorised systems and scope.
- Examine input validation, secrets handling, dependencies, privacy boundaries and file uploads.
- Review relevant WebRTC access controls and signed tokens.
- Explain tested coverage and limitations, prioritise findings and verify remediation without promising blanket security or legal compliance.
Useful additional experience
Cloudflare Workers, D1 and R2; mobile and web integrations; and threat modelling. Relevant certifications are helpful, not mandatory.
What to share
Share a sanitised report you are permitted to disclose, or describe a review you owned and how you tested cross-user access and prioritised remediation.
Experience ranges are guides, not rigid cut-offs. Prioritise relevant shipped work and demonstrated skills. Compensation and final engagement terms will be discussed separately.