Full stack end to end

# eChampz — Senior Full-Stack Developer (Fiverr brief, v2)

> Paste each block into the matching Fiverr field. Notes to Ahmed are in `>` blocks and must be deleted before posting.

---

## ABOUT THE CLIENT

The client operates a gaming and esports marketplace serving Saudi Arabia and the wider GCC. The platform connects gamers, talent scouts, studios, teams, and brands. The founder is hiring a senior developer to take technical ownership of the codebase while the founder leads the business.

---

## THE ROLE

We need a Senior Full-Stack Developer to take technical ownership of an established React and PostgreSQL platform currently in closed beta and moving toward public launch.

This is a six-month engagement structured in three stages: a paid scoped trial, a defined first milestone, then ongoing work. A longer-term or full-time arrangement may follow for the right person.

This is not a greenfield build. The product exists, has real users, and has a mature schema. We are looking for someone to own, harden, and extend it — not to rewrite it.

---

## WHAT YOU WILL OWN

**Delivery pipeline**
- Own builds, deployments, and environment management across dev, staging, and production
- Own database migrations, including a reversible rollback path for every schema change
- Own secrets management and release discipline

**API and data layer**
- Schema design and evolution across a 100+ table PostgreSQL database
- Row-Level Security policy design, review, and ongoing audit
- `SECURITY DEFINER` function design and privilege hygiene
- Serverless functions, scheduled jobs (`pg_cron`), and query performance

**Security**
- Treat the database policy layer as the authoritative enforcement layer; client-side controls are hints only
- Least-privilege grants, auth and OTP flow hardening, storage bucket policies, signed URL handling
- Append-only audit logging
- Dependency CVE scanning and secret scanning in CI
- Maintain a clean migration path toward regionally hosted infrastructure

**Content moderation**
- Build and maintain an automated moderation pipeline for user-generated text and media
- Must handle **Arabic, including Gulf dialect and obfuscated or character-substituted variants** — English-only moderation is not sufficient
- Integrate a contracted moderation provider via serverless function; design the human review queue handoff

**Mobile release**
- Package and ship the Capacitor build to the Apple App Store and Google Play
- Handle platform-conditional behaviour and store review compliance

**Bilingual and RTL correctness**
- Maintain Arabic RTL and English LTR parity on every screen, mobile and desktop
- Bidirectional text isolation, locale-correct date and number formatting, mirrored layout and directional icons

**Documentation and handover**
- Every schema change documented; every serverless function commented
- Maintain a written runbook covering deployment, rollback, scheduled jobs, and incident response
- The founder must be able to hand this codebase to a successor without a knowledge gap

**Continuous improvement**
- Ongoing performance work: frontend payload size, image handling and render-time resizing, media compression, database bloat from job history
- You are expected to identify the next problem before the founder does

---

## MUST-HAVE EXPERIENCE

- 5+ years full-stack with **deep production PostgreSQL** — not just ORM usage
- Strong React and TypeScript
- Demonstrable experience with Row-Level Security, `SECURITY DEFINER` functions, serverless edge functions, object storage policies, and managed auth
- Security experience — you can walk through a concrete attack path and its mitigation, not just name a category
- CI/CD and multi-environment management
- **A shipped bilingual Arabic RTL product. A live link is required.** Proposals without one are not reviewed.
- Clear written English and the ability to explain a technical decision to a non-technical founder without jargon

---

## STRONG PLUS

- Capacitor or React Native with completed app store submissions
- GCC market experience: local payment gateways, ZATCA e-invoicing, CST SMS sender registration
- Arabic-language content classification or moderation systems
- Native or fluent Arabic
- Migrating a managed PostgreSQL project between hosting providers without data loss
- GDPR or comparable privacy-compliance experience

---

## ANSWER THESE IN YOUR PROPOSAL

Proposals that skip these are not read. Answer them yourself — we can tell.

1. Explain the difference between enforcing a rule with a Row-Level Security policy versus a `SECURITY DEFINER` function. When would you choose each, and what specifically goes wrong if a `SECURITY DEFINER` function is written carelessly?

2. A media table stores some values as **absolute URLs containing the database project reference**, and others as relative object paths. Why does this specific inconsistency matter, what breaks because of it, and what would you do about it?

3. Walk me through migrating a live PostgreSQL project — 100+ tables, RLS policies, serverless functions, scheduled jobs, storage buckets, active users — to a new host with zero data loss and minimal downtime. Give me your sequence, not a summary.

4. Link to a product you shipped that supports Arabic RTL. Describe the hardest RTL bug you hit on it and how you fixed it.

5. Your timezone, realistic weekly availability, and hourly rate.

---

## HOW THE ENGAGEMENT WORKS

**Stage 1 — Paid trial.** A small, scoped, real task performed against a sanitised schema export. No production access at this stage. Paid at your quoted rate.

**Stage 2 — First milestone.** A defined 2–3 week scope with repository and production access, under signed NDA.

**Stage 3 — Ongoing.** Hourly or retainer across the six-month engagement.

**Terms:**
- English working language; Arabic a strong plus
- Minimum four hours daily overlap with GMT+3 (Riyadh)
- Signed NDA and full IP assignment before any repository or database access
- All work in the client's GitHub organisation
- No subcontracting without written approval
- No copying of product data to local machines under any circumstance

**Rate:** $25–35 / hour, 15–20 hours per week.

---

## TECHNICAL ENVIRONMENT

- React, Vite, TypeScript, Tailwind
- Managed PostgreSQL with 100+ tables and Row-Level Security throughout
- `SECURITY DEFINER` functions, serverless edge functions, `pg_cron` scheduled jobs, object storage
- Capacitor wrapper for iOS and Android
- GitHub source control
- Integrations: SMS/OTP, regional payment gateway, game metadata API, streaming embeds, product analytics, error monitoring
- Full English and Arabic interface with RTL as a first-class layout mode

> **Note to Ahmed — delete before posting:**
> Specific vendor names (hosting platform, payment gateway, moderation provider, analytics) are disclosed after NDA. Do not name them in the public brief.
>
> Remove the auto-attached `echampz.com` link from Fiverr's "Files & References" section. Pairing the live domain with a full stack description in a public post is unnecessary exposure. Candidates get the domain at NDA stage.

---

> ## DELETED FROM THE FIVERR VERSION — reasons
>
> **"including data relating to minors"** — removed from the security section. True, relevant to the hire, and disclosed at NDA stage. It does not belong in a public post next to your domain name.
>
> **"so releases do not go directly to production"** — removed. This announced that you have no staged deployment. Reframed as owning and improving the pipeline.
>
> **"RLS correctness"** as a fix-it item — reframed as design and ongoing audit. Never advertise which control is weak.
>
> **"the client is non-technical" / "the CEO leads the business"** — softened. Stated twice in the Fiverr draft. Once is context; twice is an invitation.
>
> **The duplicated rate block and the line "it could go hire based on what are you going to provide above and beyond"** — that was your private note leaking into the public brief. It signals the rate is negotiable upward before anyone has applied.
>
> **"Supabase" (twice, misspelled once as "Supabase"/"Supabase")** — replaced with generic Postgres terminology. Anyone who actually knows the platform recognises the shape from `SECURITY DEFINER` + RLS + edge functions + `pg_cron`. Anyone who doesn't was never a candidate.