1. Submit lengthy application (like quite long, they want essays) 2. Invited to Slack channel to manage async interview process 3. Given access to a repo with a number of tasks to complete including PR review, bug fixes, feature development, and security assessment 3. Fell short on the security assessment and rejected

I was brought into the interview by an external recruiter (I don't usually like to use recruiters, but they straight up said it was for Automattic, and that sounded like an interesting gig so I used the recruiter rather than go behind their back). I answered a couple of long-form interview questions (one-pagers) and then was invited to the code test, after some brief chatting on Slack. Someone else mentioned being intimidated by their emoji game -- That is so true lol. The code test involved fixing and making some improvements to a plugin. I've dabbled with WP plugins but as I'm primarily a frontend developer, I thought my tasks would mostly be frontend-specific. Instead, I had to really learn how this plugin worked in-and-out, which sucked because it felt like it was written with standards (using that term loosely) from a decade ago. It was quite a lot of code. Their tooling felt odd, or ancient, or both. I muddled through, but got stuck at auditing security issues -- I found a few (an XSS vulnerability, a logic error, and something else) but missed a couple more. I could've spent another day analyzing the code and buffing up on my security background, but at that point I figured (based on other reviews) that I wouldn't pass muster. I was right! So either you spend 15-25 hours on this project or you're a *really* good developer that also has experience with the quirks of wordpress development. I went in under the impression that it would be a ~6 hour test (which is way too much already) but knowing the reality of this test I'm pretty annoyed I got involved at all.