skills.rest
chriso789
chriso789COMMUNITY
Explore all skills by this author →
GitHub

pitch-crm-tenant-security-enforcer

Enforces multi-tenant isolation, RLS, and auth rules on Supabase edge functions and CRM code changes.

Updated Sep 24, 2025
Search Tags:#multi-tenant#rls#supabase#edge functions#security review#tenant isolation#webhook verification
One-click install
npx skills add https://github.com/chriso789/pitch-1 --skill pitch-crm-tenant-security-enforcer-chriso789
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: pitch-crm-tenant-security-enforcer
Source: https://github.com/chriso789/pitch-1/tree/main/.agents/skills/pitch-crm-tenant-security-enforcer
Command: npx skills add https://github.com/chriso789/pitch-1 --skill pitch-crm-tenant-security-enforcer-chriso789

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Multi-tenant SaaS codebases risk leaking one company's data to another through missing RLS policies, spoofed tenant IDs, unverified webhooks, or leaked secrets. This Skill acts as a strict security gatekeeper that reviews every backend, edge function, SQL migration, and frontend change in the Pitch CRM codebase and blocks insecure implementations before they ship. ## Core Features & Use Cases - Tenant Isolation Enforcement: Rejects code that trusts company_id from request bodies, requires JWT-based identity resolution, and mandates manual company_id filtering whenever the service role bypasses RLS. - Route Auth-Mode Declaration: Requires every edge function route to declare itself as authenticated tenant, service-role worker, public webhook, or public signed-token, with matching verification logic. - Webhook & Integration Security: Enforces signature verification for Telnyx, Stripe, and email webhooks, plus per-company scoping of QBO, Stripe, DocuSign, and other integration credentials. - Use Case: When adding a new Supabase edge function that sends bulk SMS, the Skill checks that the route declares its auth mode, resolves the tenant from the JWT, verifies DNC compliance gates, and writes an audit log before allowing completion. ## Quick Start Review this new edge function for tenant isolation, RLS coverage, webhook signature verification, and secret hygiene before I merge it.

Frequently Asked Questions about pitch-crm-tenant-security-enforcer

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I enforce multi-tenant isolation in Supabase edge functions?▼

Resolve the user from the JWT claims, look up company membership in the database, and never trust company_id from the request body. When using the service role, manually add .eq('company_id', resolvedCompanyId) to every query since it bypasses RLS.

How to verify webhook signatures for Telnyx and Stripe?▼

Webhook routes must verify the provider signature before processing any payload. Telnyx inbound messages must resolve the receiving number to the correct company_id and brand_id, and Stripe webhooks must map accounts and subscriptions to the correct tenant.

What RLS policies are required for new Supabase tables?▼

Every table holding customer, job, invoice, message, or file data must enable row level security with SELECT, INSERT, UPDATE, and DELETE policies based on company membership. Permissive USING (true) policies are rejected unless the table is documented as public by design.

Can I use the Supabase service role key in frontend code?▼

No, service role keys must never appear in frontend code, localStorage, or public environment variables. Only VITE_SUPABASE_URL and the anon publishable key belong in the client; all privileged operations go through edge functions.

Why was my edge function route rejected during review?▼

Routes are rejected when they lack a declared auth mode, query data without a company_id filter, use the service role without manual tenant filtering and audit logging, or expose secrets in error responses. Declare the route as authenticated tenant, service-role worker, public webhook, or signed-token and apply the matching checks.

Related Skills

Explore More Software Engineering Skills→
franciscosancheznfranciscosanchezn

speckit-supabase-expert.agent

Implement secure multi-tenant backends on Supabase with per-project schemas and RLS.

Community
Advanced
Async-IOAsync-IO

test-multitenant-isolation

Validate data isolation and cross-tenant access in multi-tenant applications.

Official
Advanced
nguyenpv1980-wqnguyenpv1980-wq
2

api-event-architect

Design tenant-safe external API and event contracts for multi-tenant SaaS products.

Community
Advanced
davila7davila7
30.5k

saas-multi-tenant

Implements multi-tenant SaaS architectures with PostgreSQL row-level security and tenant-scoped queries.

Community
Advanced