01 · Access
Share only what is needed
The review is scoped through the Upwork project. Do not send production passwords or service-role keys in chat.
PostgreSQL · Supabase · RLS
Your app works. Can one customer read another customer’s data?
“RLS enabled” isn’t “RLS correct.” I review the authorization layer between your PostgreSQL database and your users: Row Level Security policies, exposed objects, multi-tenant boundaries and privileged-key usage. You receive a prioritized report you can act on.
Fixed-price project · platform checkout. No account needed to ask: email cnkkurtoglu@gmail.com with two or three sentences and I will tell you whether an audit is the right thing — including when it is not.
Audit coverage
The access paths that matter
- 01Tables and views reachable through the public API
- 02SELECT, INSERT, UPDATE and DELETE policy coverage
- 03Cross-tenant access and user-ID ownership checks
- 04Anonymous versus authenticated access boundaries
- 05PostgreSQL role membership and table-level GRANTs behind the policies
- 06Views missing security_invoker, which bypass RLS on the tables underneath
- 07SECURITY DEFINER functions and risky RPC exposure
- 08Service-role key use in browser and server code
- 09Storage bucket policies where they affect the reviewed flow
- 10Actionable SQL and implementation recommendations
Reproducible proof
See the isolation test before hiring me
The public fixture uses the same five-test suite to demonstrate a missing database-level RLS boundary and its policy fix. On the current fixed branch, all five isolation checks pass locally with no cloud project, Docker setup or credentials.
Not ready for a $99 audit?
Run the 60-point launch checklist for $19
An 8-page PDF covering RLS, secrets, authentication, performance, SEO, reliability and go-live checks. It is an educational review aid—not an automated scan, penetration test or security guarantee.
Confirmed by the teams
Real reports, fixed in production
“Cenk identified a genuine and significant Supabase RLS issue in CrewForm and disclosed it privately and responsibly. His report was clear, technically accurate, and included practical steps to verify the issue and resolve it. This allowed us to confirm the problem and get a fix in place quickly. He was professional, constructive, and easy to work with throughout the process.”
Separately, an open-source maintainer fixed two vulnerabilities I reported — an anon-reachable SECURITY DEFINER function that bypassed RLS, and a USING (true)policy exposing every signed-in user's email — and credited the report in a public commit, verified against production.
02 · Review
Trace real access paths
Policies are evaluated against your user roles and data ownership model, not against a generic checklist alone.
03 · Report
Fix the highest risk first
Findings are prioritized by impact, with affected objects, reproduction notes and concrete remediation guidance.
Before you order
Supabase RLS audit questions
Is this a penetration test?
No. It is a focused review of the Supabase authorization boundary described in the Upwork scope, not a full application penetration test or security guarantee.
Can the audit cover a multi-tenant application?
Yes. Cross-tenant access is tested against the supplied membership and ownership model, including negative cases between separate synthetic tenants.
Will you need production secrets?
No production password or service-role key should be sent in chat. The review begins with the minimum anonymized schema, policies and reproduction material needed for the agreed scope.
What is included in the report?
Findings are prioritized by impact and include affected objects, reproduction notes, remediation guidance and verification evidence for the reviewed paths.
Review the service scope before ordering.
All contracting and payment stays on Upwork. Questions do not: write to cnkkurtoglu@gmail.com.