I audit Supabase authorization boundaries for teams shipping on Lovable, Bolt, Cursor and Replit.
The generated SQL is usually valid. What it misses is whether a policy that exists is actually correct: a permissive policy quietly cancelling a restrictive one, a membership join that is not isolated, or a service-role key reachable from a client path. All three pass Supabase's free linter, and all three pass tests written from a single account.
I work from read-only access or a sanitized schema dump. I never need your service-role key.... Read more