Know which users can read or change your application data. I review the Row Level Security policies and access paths in one existing Supabase project.

DELIVERABLES A scoped access map for up to five tables and two user roles; reproducible findings ranked by impact; suggested policy changes; and test cases for allowed and denied access.

PROCESS We agree the tables, roles and intended permissions. I inspect policies and application queries, reproduce findings in an authorized test environment and explain the remediation priorities.

SCOPE This is a focused technical review, not a compliance certification or unrestricted penetration test. Production policy changes, migrations and unrelated features are separately scoped. One week after complete inputs, including one clarification round.