I audit Supabase authorization boundaries. Most of my work is finding the cross-user and cross-tenant leaks that a linter cannot see: a permissive policy silently cancelling a restrictive one, a membership join that is not isolated, or a service-role key reachable from a client path. The SQL is valid in all three cases, which is why they survive review and pass tests.

If you arrived here from a Postgres or Supabase thread, start with the free fixture in the first section — the same test suite goes red on one branch and green on the other in about two seconds. The $29 kit below it is the same audit as SQL you run yourself, which is what most people want.

I also build and maintain Next.js, React and Node.js products; those are further down, labeled by evidence type so you can tell public source from live products, prototypes and private code.

Based in Türkiye

Recently confirmed in production: a project maintainer fixed two vulnerabilities I reported — an anon-reachable SECURITY DEFINER function that let any anon-key holder read any table, bypassing RLS, and a USING (true) policy exposing every signed-in user's email — and credited the report in a public commit, verified against production.

"Cenk identified a genuine and significant Supabase RLS issue in CrewForm and disclosed it privately and responsibly. His report was clear, technically accurate, and included practical steps to verify the issue and resolve it. This allowed us to confirm the problem and get a fix in place quickly. He was professional, constructive, and easy to work with throughout the process." — CrewForm

I help Next.js and Supabase teams verify cross-user and cross-tenant data boundaries with evidence-first tests. The public fixture below separates the failure signature, policy boundary, regression check and scope limitations.

Three ways in, cheapest first:

• Free — run the isolation fixture: one test file, red on one branch and green on the other, about two seconds, no Docker and no Supabase account. Also worth running Supabase's own database linter before anything here, since it is free and catches the obvious cases.
• $29 — run the audit yourself. The RLS Audit Kit on Gumroad: seven commented SQL audits you run against your own catalogs — coverage, policy conflicts, write-side WITH CHECK gaps, grants, bypass paths, Storage and Realtime — plus a role-simulation harness wrapped in BEGIN … ROLLBACK, a 60-check workflow, and report templates. Nothing leaves your database.
• From $99 — I run it. Order on Upwork, 2-day delivery, severity-ranked findings with reproducible proof.

If the free checks come back clean, you are done and you do not need either of the paid ones.

Arrived here from a Postgres or Supabase thread and would rather describe the problem first? Email [email protected]. Two or three sentences is enough, and I will tell you which of the three above applies — including when the answer is none of them. Send sanitized schema and policy SQL only, never production secrets, service-role keys or customer data.

• Read the negative-test matrix

Recent public example of the work: in a Supabase security thread about whether the Developer role can be prevented from reading project secrets, I argued the boundary cannot hold — deploy permission is transitively read-all-secrets permission, so redacting logs filters one channel while the attacker picks another. The reporter withdrew the proposal after that exchange, and the thread is now producing a documentation change rather than a redaction feature. Read the thread

Start with the free checks. Supabase ships a database linter that catches RLS switched off, and RLS switched on with no policy behind it. What a linter cannot check is whether a policy that exists is correct — a permissive policy silently cancelling a restrictive one, a membership join that is not isolated, or a service-role key reachable from a client path. That is what the audit covers.

Send only sanitized schema and policy SQL—never production secrets, service-role keys or customer data. The review returns risk-ranked findings, reproducible checks and practical policy-fix recommendations. It is not a penetration test, certification or security guarantee.

Three offers are currently promoted here. Each has public evidence or a real preview and a working platform checkout path.

A fixed-price review of your Supabase authorization boundary: every table and policy enumerated, covering SELECT, INSERT, UPDATE and DELETE policy boundaries, anonymous and authenticated roles, USING and WITH CHECK gaps, and cross-user or cross-tenant failure paths. You get severity-ranked findings with reproducible proof and a remediation plan with the SQL to apply.

• Inspect the public five-test isolation fixture
• Read the scope on the service page
• Order on Upwork — from $99, 2-day delivery

Contracting and payment stay on Upwork. The audit covers findings and recommendations for one authorized project; implementation can be scoped separately after the evidence is clear.

The same audit as a set of files you run yourself. Seven commented SQL audits against your own catalogs: RLS coverage, policy conflicts, write-side WITH CHECK gaps, grants, bypass paths, Storage, Realtime, and a role-simulation harness that wraps its probes in BEGIN … ROLLBACK. Plus a 60-check workflow and report and remediation templates.

• Run the free five-test fixture first
• Buy the kit on Gumroad — $29

For projects you own or are authorized to test. It is a configuration review workflow, not a penetration test or a security guarantee.

An evidence-led 100-point operational-readiness workflow with a dependency-free Node.js scorer, evidence ledger, 19-page playbook, regression tests, and editable client-report templates.

• Try the free 100-point scorecard
• Review a generated sample report
• Review and buy on Gumroad — $49

An 8-page PDF with 60 practical checks covering secrets, RLS, auth, performance, SEO, reliability, monitoring, backups, environment setup, and go-live.

• Preview real PDF pages
• Review and buy on Gumroad — $19

These products provide tools and guidance, not import-success, ranking, security, compliance, sales, or revenue guarantees.

The sanitized case study explains its recoverable asynchronous-job and transactional-credit design.

The full source is available as a commercial AI-SaaS starter — Next.js (App Router) + Paddle checkout with signed webhooks, a metered credit wallet, a referral system, and an HMAC-signed fal.ai generation pipeline, with Firebase Admin auth and daily cron reconciliation. It ships with .env.example and setup docs and contains no secrets. Email [email protected] for a commercial license.

This is a pre-revenue product foundation: unrestricted public generation and production-scale operation are not claimed. What you buy is the engineered codebase, not a running business.

• llms-txt-generator — public application source and public Actor listing.
• free-nextjs-cv-template — public Next.js source and a live deployment.
• nextjs-website-templates — 20 hosted starter demos with a transparent buyer guide. Review the documented scope before considering the commercial source package.

Next.js · React · TypeScript · JavaScript · Node.js · Firebase / Firestore · Apify / Crawlee · Vercel

[email protected] — the fastest way to reach me. No platform account needed, and a question is not an order: if the honest answer is that you do not need an audit, that is the answer you will get.

LinkedIn · Product catalog · Website