Supabase RLS Security Audit
Budget: $8 – $15 USD
The application already runs smoothly on Supabase + Next.js, but I want absolute confidence that the multitenant Row Level Security is watertight. Every request must stay inside its tenant boundary, enforced through well-written RLS policies and correctly issued JWT claim checks.
Scope
• Review every existing RLS policy and the corresponding Postgres functions that read tenant_id from the JWT.
• Identify gaps, redundant rules, or places where policy precedence could leak data between tenants.
• Stress-test the current setup with the sample data I’ll provide; simulate cross-tenant access attempts and verify they fail.
• Refactor or rewrite policies and functions where needed, keeping naming conventions and code style consistent with the repo.
Acceptance criteria
• For every table, a user assigned to tenant A can never see or modify rows belonging to tenant B (verified through the provided tests).
• All JWT claim functions consistently extract tenant_id and other relevant claims without nullable fall-through.
• Supabase’s policy debugging view shows no “default-permit” situations.
Tools likely involved include the Supabase dashboard, psql, SQL sensible for Postgres 15, and Supabase CLI for local testing. Once the updated policies pass the sample data tests, the job is complete.
Scope
• Review every existing RLS policy and the corresponding Postgres functions that read tenant_id from the JWT.
• Identify gaps, redundant rules, or places where policy precedence could leak data between tenants.
• Stress-test the current setup with the sample data I’ll provide; simulate cross-tenant access attempts and verify they fail.
• Refactor or rewrite policies and functions where needed, keeping naming conventions and code style consistent with the repo.
Acceptance criteria
• For every table, a user assigned to tenant A can never see or modify rows belonging to tenant B (verified through the provided tests).
• All JWT claim functions consistently extract tenant_id and other relevant claims without nullable fall-through.
• Supabase’s policy debugging view shows no “default-permit” situations.
Tools likely involved include the Supabase dashboard, psql, SQL sensible for Postgres 15, and Supabase CLI for local testing. Once the updated policies pass the sample data tests, the job is complete.