Browse categories
Explore
Fiverr Pro
English
$
USD
I will audit your supabase rls and find the data leak your linter cannot see
Cenk Kurtoglu
About this gig
Your Supabase linter says everything is fine. That is not the same as being safe.
The linter checks whether policies exist. It does not check whether they are correct. I read the policies themselves and find the leaks that pass every automated check.
WHAT I LOOK FOR
- USING (true) with no role restriction, so anon inherits access meant for logged-in users
- Join and membership tables that are not isolated, letting one tenant reach another tenant's rows
- Service-role keys reachable from client code, which bypasses RLS entirely
- Permissive policies quietly cancelling restrictive ones
- RLS enabled with no policy at all, or open storage buckets
WHAT YOU GET
A report of each real finding, ranked by severity, with the exact SQL that reproduces it on your database. If your policies are sound, I say so plainly instead of inventing problems.
Standard adds corrected policies as ready-to-run migrations. Premium adds a pgTAP suite that fails on the vulnerable policy and passes on the fix.
Read-only access or a schema dump is enough.
I publish a reproducible RLS leak demo and its fix on GitHub, and Supabase security confirmed my analysis of a real issue. Message me first.
Get to know Cenk Kurtoglu
Cenk Kurtoglu
Supabase RLS security audits
- FromTurkey
- Member sinceJun 2024
Languages
English, Turkish
I audit Supabase authorization boundaries for teams shipping on Lovable, Bolt, Cursor and Replit.
The generated SQL is usually valid. What it misses is whether a policy that exists is actually correct: a permissive policy quietly cancelling a restrictive one, a membership join that is not isolated, or a service-role key reachable from a client path. All three pass Supabase's free linter, and all three pass tests written from a single account.
I work from read-only access or a sanitized schema dump. I never need your service-role key.
FAQ
Do you need my service-role key or production data?
No. Read-only database access or a schema dump with your policy definitions is enough. I never ask for your service-role key, admin credentials, or a copy of your production data, and you should not send them to any auditor.
What if you find nothing wrong?
Then I tell you that, and the report says so. A clean result is a real result: you get written evidence that your policies hold, with the queries I ran to prove it. I will not invent findings to justify the price.
