I will audit your supabase, lovable or base44 app for security holes

Most apps built with Lovable, Bolt or Base44 ship with at least one hole: a Supabase table with no row level security, a secret key in the frontend, a storage bucket anyone can list. I find those before your users or a stranger does.

What I check:

• Row level security on every table, tested with a second account
• API keys and secrets exposed in the browser
• Auth: password reset, email confirmation, sessions
• Storage buckets and file access
• Edge functions and webhooks that skip auth
• Rate limits on signup and AI endpoints, so nobody runs up your OpenAI bill

You get a written report: each issue, how serious it is, and the exact fix. In the higher packages I fix them and re-test.

I need read access to your Supabase project or repo, not your production passwords.

This is a practical audit for small apps. It is not a formal penetration test or a compliance certificate, so if you need SOC 2 or HIPAA paperwork, I'm the wrong seller.