Security review of web app sign-in, invites and account deletion (TypeScript/Node)

We need a security review of a TypeScript/React PWA with a Hono server and Postgres. Review Apple and Google OAuth and magic-link sign-in, trip invitations, and account deletion. After a mutual NDA, you will get read-only GitHub access at a named commit; cloning and running locally is OK... (Budget: $250 - $750 USD, Jobs: Node.js, OAuth, Penetration Testing, PostgreSQL, Security, Typescript, Web Security)