I built the auth layer with admin 2FA, social and phone sign-in and rate limiting, and in a security review I closed an account-takeover path and an MFA bypass. On top of that: profiles with skills, accreditations and auto-geocoding, job posting and applications, a discovery search that ranks tradespeople by availability, distance, rating and budget, and Stripe subscriptions with webhooks.