Browse categories
Explore
Fiverr Pro
English
$
USD
I will find and fix supabase data leaks in your lovable or cursor app
Karthik M R
About this gig
Apps built fast with Lovable, Bolt, Cursor or Claude Code often ship with Supabase data leaks: tables with RLS turned off, policies that let any logged-in user read every row, service keys in the frontend, and AI agents that can drop tables.
I find these and fix them for you.
What I do:
- Build a local copy of your database schema from your migrations. I never connect to your live database and never see your users' data.
- Run three checks: the Supabase Security Advisor, a user A vs user B leak test, and Karchi Guard, my open-source check for AI agent access (keys, MCP servers, Claude Code rules, backups).
- Write a plain-English report: what is wrong, why it matters, how bad it is.
- Send a pull request with the fixes (RLS migration and safer agent settings), then re-check.
You get: the report, the pull request, and a before/after result.
I will not call your app "100% secure". I tell you exactly what was checked and what was not.
Bigger project (more than 15 tables)? Message me before ordering.
Get to know Karthik M R
Karthik M R
Supabase security and Python developer
- FromIndia
- Member sinceOct 2026
Languages
English
I'm Karthik, a Python and Supabase developer from India. I build apps with Supabase and AI agents, and I check them for data leaks. I made Karchi Guard, a free open-source tool that shows what an AI coding agent can read or destroy in a Supabase project. I find and fix RLS leaks, exposed keys and unsafe agent settings, test with two real test users, and send you a pull request with the fix. I never touch your live data.
FAQ
Do you need my Supabase password or keys?
No. I work from your code and schema only. If I find a leaked key, I tell you how to rotate it in your own dashboard.
Will you change my live database?
No. You get a pull request. You review it, merge it, and apply the migration yourself.
My app was built with Lovable. Does this work?
Yes, as long as the project uses Supabase and you can share the code (Lovable can sync to GitHub).
My app says "permission denied for table" since 30 October. Can you fix that?
Yes. That is Supabase's new rule for new tables. I add the grants together with RLS and an owner policy, so the fix does not open your data to everyone.
What if you find nothing?
You still get the report showing what was checked. That is useful proof for you.
