Codebase Security Review

Overview We're looking for an experienced application security professional to review the codebase for a web app that handles sensitive borrower data (documents, personal information) before we launch it into user testing. We need someone to identify real vulnerabilities — not just run a scanner — and give us clear, prioritized recommendations we can act on before launch. The codebase ~13,000 lines total The repository contains 9,868 lines of first-party application code, measured as physical lines including comments and blank lines. Backend Python: 5,144 Frontend JSX/CSS/HTML: 3,954 Database migrations: 770 Tests: 3,027 So, including tests: 12,895 lines. Backend: Python/FastAPI (single app/ module), SQLAlchemy 2.0 + Alembic migrations, PostgreSQL in production (Heroku), SQLite in dev Frontend: React 18, vendored as UMD files (not an npm dependency), with Babel compiling frontend/app.jsx → static/app.js — no bundler, no runtime JS dependencies Integrations: Salesforce sync, Google Drive (file uploads/storage), SendGrid (magic-link login emails) Auth: passwordless/magic-link login, rate-limited via slowapi What we need reviewed Magic-link authentication — token generation, expiry, and replay protection Authorization checks across API routes — making sure users can only access their own data The Salesforce and Google Drive integrations — credential handling and data exposure risk File upload handling General exposure to OWASP Top 10-style risks Scope Manual source code review (not just an automated scan report) Written findings with severity ratings and concrete remediation steps Dynamic/penetration testing against a staging environment is a nice-to-have