I will audit your supabase security, rls policies, functions and auth

Your Supabase anon key is public. Anyone can copy it from your app and call your database directly. The only thing between them and your users' data is your RLS policies, your function grants and your auth settings. I check all three.

If your app was built with Lovable, Bolt or Cursor, this matters more: after the April 2026 Lovable disclosure, owners were told to rotate keys and check RLS on every table by hand.

What you get:

• Every finding rated Critical to Info, with the exact request that proves it, the impact and the fix SQL.
• A scorecard per area: RLS coverage, policy design, function exposure, auth, storage.
• Live tests using only your anon key, so findings are real, not theoretical.
• A clear list of what was not tested.

I built a multi-tenant clinic SaaS on Supabase with RLS and SECURITY DEFINER helpers, and I use the same checklist on my own project.

I never ask for your service-role key. Read-only SQL access plus the anon key is enough. Message me your project ref and repo link and I will confirm the scope before you order.