I audit Supabase authorization boundaries. Most of my work is finding the cross-user and cross-tenant data leaks that a linter cannot see: a permissive policy silently cancelling a restrictive one, a membership join that is not isolated, or a service-role key reachable from a client path. The SQL is valid in all three cases, which is why they survive code review and pass tests.

If you arrived here from a Postgres or Supabase thread about RLS not working, anon key exposure, or SECURITY DEFINER bypassing your policies, start with the free tools below. The same SQL goes red on one branch and green on the other in about two seconds. No Docker, no Supabase account needed.

I also build and maintain Next.js, React and Node.js products; those are further down, labeled by evidence type so you can tell public source from live products, prototypes and private code.

Based in Turkiye

Recently confirmed in production: a project maintainer fixed two vulnerabilities I reported -- an anon-reachable SECURITY DEFINER function that let any anon-key holder read any table, bypassing RLS, and a USING (true) policy exposing every signed-in user's email -- and credited the report in a public commit, verified against production.

Most recent merge: a review-driven hardening migration for StudentSuite/StudyMap -- place-type CHECK constraint, lat/lng bounds shipped as NOT VALID + VALIDATE so the rollout cannot lock the table, plus explicit WITH CHECK on the UPDATE policies; merged after addressing two rounds of maintainer review.

'Cenk identified a genuine and significant Supabase RLS issue in CrewForm and disclosed it privately and responsibly. His report was clear, technically accurate, and included practical steps to verify the issue and resolve it. This allowed us to confirm the problem and get a fix in place quickly. He was professional, constructive, and easy to work with throughout the process.' -- CrewForm

'I built my AI assistant Victorio with Claude and was very happy with it -- not having ANY idea about the security aspects of this build and what it could mean for my data. Then I got an email from Cenk. I put it into Claude and guess what Claude said: Cenk is absolutely right and 100% of this email is correct. Claude apologized for not thinking through security correctly. I then bought Cenk's checklist, and with it Claude was able to plug all my security holes. I am very thankful to Cenk -- he is amazing, and I highly recommend all founders who are not technical to talk to him.' -- Stan Altshuller, Founder & CEO, Acadia.im

Run these against your own database to check for common security gaps.

• RLS Production Checklist -- 7 SQL queries: tables with RLS on but no policy, USING(true) on anon, SECURITY DEFINER callable by anon, missing TO clauses
• Service Role Detection -- find exposed service_role keys, SECURITY DEFINER functions, and direct grants
• SECURITY DEFINER Audit -- list all SECURITY DEFINER functions, check anon EXECUTE privileges, find dynamic SQL injection vectors
• Two-User RLS Test (no pgTAP) -- prove tenant isolation on a live database with plain psql: act as user A and B via request.jwt.claims, probe every access path, self-verify the harness catches permissive policies

Also worth running Supabase's own database linter, since it is free and catches the obvious cases.

I help Next.js and Supabase teams verify cross-user and cross-tenant data boundaries with evidence-first tests. The public fixture below separates the failure signature, policy boundary, regression check and scope limitations.

Three ways in, cheapest first:

• Free -- run the isolation fixture: one test file, red on one branch and green on the other, about two seconds, no Docker and no Supabase account.
• ** -- run the audit yourself.** The RLS Audit Kit on Gumroad: seven commented SQL audits you run against your own catalogs -- coverage, policy conflicts, write-side WITH CHECK gaps, grants, bypass paths, Storage and Realtime -- plus a role-simulation harness wrapped in BEGIN/ROLLBACK, a 60-check workflow, and report templates. Nothing leaves your database.
• From -- I run it. Order on Upwork, 2-day delivery, severity-ranked findings with reproducible proof.

If the free checks come back clean, you are done and you do not need either of the paid ones.

Arrived here from a Postgres or Supabase thread and would rather describe the problem first? Email cnkkurtoglu@gmail.com. Two or three sentences is enough, and I will tell you which of the three above applies -- including when the answer is none of them. Send sanitized schema and policy SQL only, never production secrets, service-role keys or customer data.

• Read the negative-test matrix

Recent public example of the work: in a Supabase security thread about whether the Developer role can be prevented from reading project secrets, I argued the boundary cannot hold -- deploy permission is transitively read-all-secrets permission, so redacting logs filters one channel while the attacker picks another. The reporter withdrew the proposal after that exchange, and the thread is now producing a documentation change rather than a redaction feature. Read the thread

Start with the free checks. Supabase ships a database linter that catches RLS switched off, and RLS switched on with no policy behind it. What a linter cannot check is whether a policy that exists is correct -- a permissive policy silently cancelling a restrictive one, a membership join that is not isolated, or a service-role key reachable from a client path. That is what the audit covers.

Send only sanitized schema and policy SQL -- never production secrets, service-role keys or customer data. The review returns risk-ranked findings, reproducible checks and practical policy-fix recommendations. It is not a penetration test, certification or security guarantee.

These are the most frequent issues in production Supabase projects:

1. RLS policies with USING(true) -- a permissive policy that allows all rows to be read by anyone, overriding restrictive policies
2. SECURITY DEFINER functions callable by anon -- bypasses RLS entirely, anon-key holders can read any table
3. service_role key in client code -- if NEXT_PUBLIC_ prefix is on the service_role key, it is exposed to the browser
4. Unisolated membership joins -- cross-tenant data leaks through joins that do not filter by user_id or org_id
5. Write-side WITH CHECK gaps -- INSERT and UPDATE policies that allow users to create rows under any user_id
6. Storage policies missing object-level access control -- anyone with the bucket name can read/download files

See the Gist links above for SQL queries that detect each of these.

Three offers are currently promoted here. Each has public evidence or a real preview and a working platform checkout path.

A fixed-price review of your Supabase authorization boundary: every table and policy enumerated, covering SELECT, INSERT, UPDATE and DELETE policy boundaries, anonymous and authenticated roles, USING and WITH CHECK gaps, and cross-user or cross-tenant failure paths. You get severity-ranked findings with reproducible proof and a remediation plan with the SQL to apply.

• Inspect the public five-test isolation fixture
• Read the scope on the service page
• Order on Upwork -- from , 2-day delivery

Contracting and payment stay on Upwork. The audit covers findings and recommendations for one authorized project; implementation can be scoped separately after the evidence is clear.

The same audit as a set of files you run yourself. Seven commented SQL audits against your own catalogs: RLS coverage, policy conflicts, write-side WITH CHECK gaps, grants, bypass paths, Storage, Realtime, and a role-simulation harness that wraps its probes in BEGIN/ROLLBACK. Plus a 60-check workflow and report and remediation templates.

• Run the free five-test fixture first
• Buy the kit on Gumroad --

For projects you own or are authorized to test. It is a configuration review workflow, not a penetration test or a security guarantee.

An evidence-led 100-point operational-readiness workflow with a dependency-free Node.js scorer, evidence ledger, 19-page playbook, regression tests, and editable client-report templates.

• Try the free 100-point scorecard
• Review a generated sample report
• Review and buy on Gumroad --

An 8-page PDF with 60 practical checks covering secrets, RLS, auth, performance, SEO, reliability, monitoring, backups, environment setup, and go-live.

• Start free -- the 10-check pre-launch pass: a 2-page PDF, pay what you want -- enter 0 to download. The fastest way to see the format before the full 60.
• Preview real PDF pages
• Review and buy on Gumroad --

These products provide tools and guidance, not import-success, ranking, security, compliance, sales, or revenue guarantees.

Creators, consultants and agencies: if your audience ships Supabase or Next.js apps, you can earn a 50% commission promoting any of these -- 30-day tracking, nothing owed unless it converts. Join the affiliate program.

The sanitized case study explains its recoverable asynchronous-job and transactional-credit design.

The full source is available as a commercial AI-SaaS starter -- Next.js (App Router) + Paddle checkout with signed webhooks, a metered credit wallet, a referral system, and an HMAC-signed fal.ai generation pipeline, with Firebase Admin auth and daily cron reconciliation. It ships with .env.example and setup docs and contains no secrets. Email cnkkurtoglu@gmail.com for a commercial license.

Renderivo itself is live with open signup -- a free account includes one Rapid text-to-3D generation. What the commercial license buys is the engineered codebase, not the running business; production-scale operation is not claimed.

• llms-txt-generator -- public application source and public Actor listing.
• free-nextjs-cv-template -- public Next.js source and a live deployment.
• nextjs-website-templates -- 20 hosted starter demos with a transparent buyer guide. Review the documented scope before considering the commercial source package.

Next.js -- React -- TypeScript -- JavaScript -- Node.js -- Firebase / Firestore -- Apify / Crawlee -- Vercel

cnkkurtoglu@gmail.com -- the fastest way to reach me. No platform account needed, and a question is not an order: if the honest answer is that you do not need an audit, that is the answer you will get.

LinkedIn -- Product catalog -- Website