Verified:GitHub

eightforge-supabase-reviewer

Reviews Supabase and Postgres runtime persistence for RLS, tenant isolation, and service-role safety.

Updated Mar 8, 2026

Search Tags:#code review #security #multi-tenant #rls #supabase #row level security #postgres

One-click install

npx skills add https://github.com/EricAnalysis/eightforge-os --skill eightforge-supabase-reviewer-ericanalysis

Or copy as Structured Prompt for Agent▼

Please help me install this Agent Skill.
Skill: eightforge-supabase-reviewer
Source: https://github.com/EricAnalysis/eightforge-os/tree/main/.cursor/skills/eightforge-supabase-reviewer
Command: npx skills add https://github.com/EricAnalysis/eightforge-os --skill eightforge-supabase-reviewer-ericanalysis

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Multi-tenant Supabase applications risk cross-tenant data leaks, missing Row Level Security, exposed service-role keys, and unsafe privileged writes. This Skill provides a structured expert review of runtime persistence and access behavior so these issues are caught before they reach production. ## Core Features & Use Cases - RLS and Tenant Isolation Review: Verifies Row Level Security is enabled, policies enforce organization and project scoping, and no IDOR or cross-tenant reads/writes exist. - Privileged Access Safety: Checks that service-role keys never appear in client bundles or untrusted contexts and that mutations flow through authenticated server paths. - Transaction and Idempotency Analysis: Evaluates multi-row writes for atomicity, retry safety, conflict handling, and honest labeling of best-effort side effects. - Use Case: Before merging a pull request that adds a new API route writing to a projects table, run this review to confirm the route validates auth, filters by project_id, respects RLS policies, and classifies the table's authority correctly. ## Quick Start Review my Supabase API routes and RLS policies for tenant isolation and service-role safety issues.

Frequently Asked Questions about eightforge-supabase-reviewer

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

Why does the review require authority classification of tables?▼

A deployed table or canonical-looking name does not prove it is live production authority. Classifying each table as production authority, compatibility, shadow, design target, or superseded prevents shadow tables from silently becoming authoritative without explicit cutover evidence.