Is this a penetration test?
No. It is a focused review of the Supabase authorization boundary described in the Upwork scope, not a full application penetration test or security guarantee.
Supabase · RLS · Next.js
Your app works. Can one customer read another customer's data?
I review the authorization layer between your Supabase database and your users: RLS policies, exposed objects, tenant boundaries and privileged-key usage. You receive a prioritized report you can act on.
Order the audit on Upwork — from $299Fixed-price project · platform checkout
Audit coverage
The access paths that matter
- 01Tables and views reachable through the public API
- 02SELECT, INSERT, UPDATE and DELETE policy coverage
- 03Cross-tenant access and user-ID ownership checks
- 04Anonymous versus authenticated access boundaries
- 05Security-definer functions and risky RPC exposure
- 06Service-role key use in browser and server code
- 07Storage bucket policies where they affect the reviewed flow
- 08Actionable SQL and implementation recommendations
Reproducible proof
See the isolation test before hiring me
The public fixture uses the same five-test suite to demonstrate a missing database-level RLS boundary and its policy fix. On the current fixed branch, all five isolation checks pass locally with no cloud project, Docker setup or credentials.
Not ready for a $299 audit?
Run the 60-point launch checklist for $19
An 8-page PDF covering RLS, secrets, authentication, performance, SEO, reliability and go-live checks. It is an educational review aid—not an automated scan, penetration test or security guarantee.
01 · Access
Share only what is needed
The review is scoped through the Upwork project. Do not send production passwords or service-role keys in chat.
02 · Review
Trace real access paths
Policies are evaluated against your user roles and data ownership model, not against a generic checklist alone.
03 · Report
Fix the highest risk first
Findings are prioritized by impact, with affected objects, reproduction notes and concrete remediation guidance.
Before you order
Supabase RLS audit questions
Can the audit cover a multi-tenant application?
Yes. Cross-tenant access is tested against the supplied membership and ownership model, including negative cases between separate synthetic tenants.
Will you need production secrets?
No production password or service-role key should be sent in chat. The review begins with the minimum anonymized schema, policies and reproduction material needed for the agreed scope.
What is included in the report?
Findings are prioritized by impact and include affected objects, reproduction notes, remediation guidance and verification evidence for the reviewed paths.
Review the service scope before ordering.
All contracting and payment stays on Upwork.