Application / Full Stack Engineer

Tell us how you build.

Short, specific answers beat long ones. Your draft is kept in this browser until you submit.

01 About you

Full name

Location and timezone

Hours per week you can give

GitHub or portfolio

LinkedIn optional

This is a paid role, but the budget is still being negotiated, so we cannot give you a number yet. Does that work for you?

Yes, I can start before the budget is set I need the number before I start Contact me once the budget is set

02 Your experience

What is your stack?

Frontend, backend, databases, authentication, hosting, testing. Mark what you have used in production.

How well do you know OAuth and GitHub App authentication?

Describe one product you built end to end.

What did you build on each side, how did you know it worked for users, and what broke first?

03 How you would work here

A customer installs our GitHub App on 3 of their 40 repositories, then adds 10 more a week later. The dashboard still shows only the first 3. Where can this break, from webhook to UI, and how do you find it?

A user suppresses a finding in the dashboard with the reason "accepted risk". The next push to the pull request still shows it in the comment. How do you design suppressions so the comment, SARIF and dashboard always agree?

The dashboard calls GET /api/findings?repo=acme/infra. The handler checks that the user is logged in, then returns the findings for the repository in the query string. What is wrong?

Nothing, the user is authenticated It should be a POST request It never checks that the user may access that repository, so anyone logged in can read any customer's findings The repository name is not URL encoded

04 Design problem

Today the product is only a GitHub Action. We want a team to install the GitHub App, pick repositories, and get a useful result on their next Terraform or OpenTofu pull request.

There is no dashboard yet. Plan content in pull requests is untrusted, and customers must never see each other's data.

How would you build the first-run experience end to end?

Cover these points. If you think the brief is wrong in part, say so and explain why.

Installation, authentication and permissions: what we ask GitHub for, and why
What the user sees between installation and the first pull request
Data model and API behind it
How the Action and the web app share configuration and results
Failure states: missing plan, unsupported provider, incomplete analysis
Security: tenancy, tokens, untrusted plan content
What you would build in the first two weeks

0 words. Most good answers run 300 to 800.

Your answers are used only to review this application.

Tell us how you build.

Thank you.