Hire Node.js developers you can test before you commit
For an Express, NestJS or Fastify service, running or still to be built. Set our developer the same test you would set anyone, marked against the Node.js and Express projects' own guidance.
Tell us what the service does
You speak directly to a senior software engineer. A shortlist typically comes back within a few days of your brief.
Who does the work after the interview
The failure to rule out is substitution: you interview someone capable, then the commits arrive from a name you have never spoken to. One person described exactly that on Hacker News in July 2020 (opens in a new tab).
On several occasions I would interview a competent guy and then the work would clearly get delegated to someone inexperienced.
That is one account, not a rate. If you do not read Node.js yourself, there is a second problem: the only evidence the developer is good is the word of whoever sent them. Both can be checked before you commit.
How to test a Node.js developer before you hire one
Set a short task on your kind of API; the candidate walks you through it live. A technical advisor can mark it with the key below.
- Set the task
One small endpoint: accept a JSON body, validate it, read and write your kind of data, compute over many rows, return the result.
- Receive it
Code in a repository you can open, with a note on how to run it.
- Walk through it live
Camera on, the candidate explains each choice. A take-home alone can be done by someone else.
- Mark it
Against the six rows of our marking key, each resting on the Node.js or Express documentation.
Set it to whoever you are considering, ours included. You can run your full hiring loop on anyone we propose, or skip it.
What a pass and a fail look like
A pass keeps the event loop free, limits and validates what clients send, handles async errors in one place and traces advisories to their source. Each pass line rests on the Node.js or Express project's own documentation, so you can hold anyone to it, ours included.
| What to check | What to ask or look for | A pass | A fail | Source |
|---|---|---|---|---|
| Blocking the event loop | What do other users get while one request runs a slow loop? How would you build a million-row report? | Everyone waits, as the loop is shared. Chunk the work or move it to a worker. | Thinks async code runs in parallel by itself. | Node.js, Don't Block the Event Loop |
| Sync calls on the request path | Search for readFileSync, pbkdf2Sync and similar, or run node --trace-sync-io locally. | None after startup. | A sync file or crypto call in a route handler. | Node.js, Don't Block the Event Loop; Express, Production best practices: performance |
| Large JSON from a client | What happens when someone posts a 50MB body? | A body size limit on every JSON endpoint. | No limit. | Node.js, Don't Block the Event Loop |
| Errors in async code | How does an error three awaits deep reach the client? | One central error handler. Knows try-catch misses async code. Checks the Express major first. | Logs uncaughtException and carries on. | Express, Production best practices: performance |
| Input validation | Every route that takes a body, query or params. | Schema validation on each. | Trusts whatever the client sends. | Express, Production Best Practices: Security |
| Dependencies | Run npm audit on the submission. | Traces an advisory to the package that pulls it in, then upgrades or replaces it. | Silences the audit. | Express, Production Best Practices: Security |
Database and API fit has no published key: give them one of your real tables to model and ask why. For the first row in depth, read what an event loop does with a thousand idle sockets.
Before you hire an Express.js developer for a running service, run five checks on the service itself. Our backend work spans Node.js on NestJS, Express, Fastify, Hono and AdonisJS, and we work inside the one you run.
Hiring an Express.js developer for a running service
The Express major
Is the first job an upgrade?
Check package.json. The Express project says 2.x and 3.x are no longer maintained.
NODE_ENV
Is production running with development settings?
The Express project says NODE_ENV set to production makes Express cache view templates and send less verbose errors.
Security headers
Were the headers set on purpose?
Look for Helmet, which the Express project names for security-related response headers.
The login route
Can a password be guessed at speed?
The Express project says to block attempts on two counts: failures per user name and IP address, and failures per IP address over a long period.
What sits in front
Does Node.js face the internet directly?
The Fastify project calls that an anti-pattern and recommends a reverse proxy.
Run these five on your own service. The answers show what the first weeks of work would be.
What a Node.js service actually depends on
On far more code than its own. Installing an average npm package means implicitly trusting around 80 others, which is why the last row of the key exists.
Show data table
| Segment | Value (packages) | Share |
|---|---|---|
| The package you chose | 1 | 1.2% |
| Packages you implicitly trust through it | 80 | 98.8% |
The same study found the average npm package transitively relies on code published by 40 maintainers. Taking over a service means reading this tree first.
Run npm ls --all against your service and count what comes back. That is what a new developer has to reason about.
When a Node.js version stops getting critical fixes
On the published end date of its line. A Node.js LTS line typically gets critical bug fixes for 30 months in total, and every major has a date after which they stop.
Show data table
| Measure | Value | Target | Range |
|---|---|---|---|
| v20 Iron, published end date 30 April 2026 | 0 months | 30 months | 0 months to 30 months |
| v22 Jod, published end date 30 April 2027 | 7 months | 30 months | 0 months to 30 months |
| v24 Krypton, published end date 30 April 2028 | 19 months | 30 months | 0 months to 30 months |
v20 Iron has passed its end date, so a service still on it gets no critical bug fixes from the Node.js project. On the published schedule, v24 moves to maintenance on 20 October 2026 and v26 is scheduled to become LTS on 28 October 2026.
How long an upgrade takes depends on the dependencies left untouched since the last one and the tests that were never written.
Check which Node.js major production actually runs, and put its published end date in your calendar.
Your test covers one task. After that, every change goes through code review by a senior software engineer, and the code lives in your repositories, so the author of every commit is visible to you.
What a change clears before merge
Gate 1
A senior software engineer reads it
Every change, before it goes anywhere.
Hands upward
A change someone besides its author will sign.
Gate 2
Branching discipline
GitFlow, so unfinished work stays off the main line.
Hands upward
A history you can read backwards.
Gate 3
Unit and integration tests
Required, not encouraged.
Hands upward
A failure you see before a customer does.
Gate 4
CI/CD gating the merge
The pipeline decides, not a person under deadline pressure.
Hands upward
A merge that means the same on any day.
Gate 5
Architecture decisions written down
In the technical requirement specification, so anyone reading the system later knows why it is shaped the way it is.
Hands upward
A decision your team can argue with later.
These are the gates on our side of the work. The branch protection on your own repository is yours to configure.
Ask everyone else bidding the same three questions: who reviews each change, which tests run, and what gates the merge.
Bring your test to the pilot
A short pilot sprint comes first. It is judged against evaluation criteria agreed with you, and your own task and marking key are what you bring to that agreement.
- Agreed with you: the criteria the pilot is judged against.
- On a miss: we replace the developer and re-run the pilot with the next candidate.
- 10:00 to 19:00 IST: the working day, with every developer currently based in India.
- 04:30 to 13:30 UTC: the same day in UTC. European teams get a substantial afternoon overlap.
- On request: a project coordinator can host a live standup, or an overlap shift can be arranged.
- A few days: from your brief to a shortlist, typically.
- Day 1: every line of code is your IP.
Ask us what the pilot would be judged on for your service, before you commit.
Ask what the pilot is judged onWhat happens, and what you are handed
01
The brief
The service, the runtime, and what someone must own.
You get
A shortlist, typically within a few days.
02
Your test or interview
Your task and key, your own interview, or neither.
You get
Your own evidence on the person.
03
The pilot
A short pilot sprint, in your repository.
You get
A result against the agreed criteria, and the next candidate on a miss.
04
The technical requirement specification
Architecture decisions recorded as they are made.
You get
A specification you can dispute before it is built.
05
Any change of scope
Time, effort and cost laid out before approval.
You get
A change note, signed off by you in writing.
06
Offboarding
The knowledge stays with the work.
You get
An operational runbook that goes with you.
Send the brief. A shortlist typically comes back within a few days.
What the service does, what it runs on, and what someone must own.
Send the briefWhat you own, and what you can check before you sign
- Your IP is yours from day one, not on final payment.
- The code lives in your repositories.
- Deployments run in your cloud accounts.
- Documentation written during the engagement is yours, including the specification.
- An operational runbook goes with you at offboarding.
- An NDA from day one, access through SSO, and secure repositories.
Put these six to everyone bidding, in these words. An answer that comes back as a principle rather than a term is worth knowing before you sign.
What changes the shape of the work
| What we would ask about | The lighter shape | The heavier shape | What decides it |
|---|---|---|---|
| The runtime | The lighter shapeInside its published support window | The heavier shapePast its end date, with stale dependencies | What decides itYour production Node.js version |
| Who else knows it | The lighter shapeSomeone internal can explain it | The heavier shapeNobody on the team wrote it | What decides itWhether a person can be asked |
| What the tests cover | The lighter shapeThe risky request paths | The heavier shapeGreen, and proves little | What decides itCoverage of paths that carry money or data |
| What the work is for | The lighter shapeA scoped fix, pilot or specialist project | The heavier shapeStanding capability, usually three months or longer | What decides itOne problem solved, or a capability held |
Length follows the work, not the contract, and we do not impose minimum-spend traps. Any change of scope becomes a change note you sign off before it enters the plan.
Send the shape of the work, using those four rows if it helps.
A shortlist typically comes back within a few days of your brief.
Send the shape of the workThree situations where this is the wrong hire
Is a Node.js developer what you actually need, or is one of these three situations closer to yours?
You have the person, not the time
Choose this when
Someone on your team knows the service but has a full queue.
It costs you
Clearing their queue costs less and keeps their context.
The problem is broader than the runtime
Choose this when
The work sits in queues, multi-tenant data isolation, or a service layer across runtimes.
It costs you
A runtime-scoped hire keeps hitting the edge of its remit.
Nobody internal will review the work
Choose this when
No one on your side will read the changes and push back.
It costs you
A placed developer performs at the level of the review they get.
If one of those is you, we would rather say so now than partway through a pilot. For the second, see hiring a backend software engineer. If the same person must own the screens too, see a full-stack software engineer who owns the UI as well.
Hiring Node.js developers: testing, vetting, start dates, scope
Can I set my own test for a Node.js programmer you propose?
How are your Node.js developers for hire vetted?
Can I hire a Node.js expert for one fix rather than a full-time developer?
Do your developers work in Express, NestJS or Fastify?
How quickly can a Node.js developer start?
Do DevOps and QA come with the developer?
Hiring a DevOps software engineer for the pipeline and deployment side
Tell us what the service does and what breaks
Either we take the work, or we tell you directly that it is not a fit. No obligation either way.
A shortlist typically comes back within a few days of your brief.
- You speak directly to a senior software engineer.
- You can set our developer your own test.
- Everything you share stays private.