I will review your supabase app rls, roles and database security

Your AI-built app works. But can one user read another user's data?

I review Supabase/PostgreSQL apps built with Lovable, Bolt, Cursor, Replit or Base44, and I focus on what your database actually allows, not what the AI tool says it set up.

This is a manual review, not a scanner dump. Each package has a fixed amount of time, so I go deep on a defined scope instead of skimming everything.

What I check (depending on package):

• Row Level Security policies and table access
• User, role and tenant isolation (can user A reach user B's data?)
• Auth configuration and role claims
• SECURITY DEFINER functions, RPCs and search_path
• Storage bucket policies and exposed keys
• Edge Functions, API exposure and one business flow (Premium)

You get a report ranked by severity, with the issue, the evidence, the affected component, the risk and how to fix it.

Not included: formal penetration testing, compliance certification, or me changing your code. Need a re-check after you fix things? Add the Retest extra.

I only need read-only access or your schema/migrations. I never ask for your service-role key.

Got a long checklist? Message me first and I'll tell you which package covers it properly.