What problem does it solve? Multi-tenant Supabase backends accumulate silent security risks: tables without RLS, overly broad USING (true) policies, service-role keys leaking into frontend code, wildcard CORS on admin endpoints, and missing webhook signature checks. This Skill runs a structured ten-gate audit that finds, classifies, and proposes remediations for these issues without applying changes silently. ## Core Features & Use Cases - Ten-Gate Security Sweep: Scans for tables without RLS, broad policies, service-role abuse in edge functions, frontend calls that bypass server gates, public storage buckets, wildcard CORS, missing auth checks, missing tenant filters, committed secrets, and platform hardening gaps. - Severity Classification: Every finding is rated P0 (critical, e.g., cross-tenant exposure), P1 (high), or P2 (info), with redacted evidence and review-only remediation SQL or code diffs. - Ordered Remediation Plan: Produces migrations in a strict sequence — rotate secrets, enable RLS, add tenant-scoped policies, patch edge functions, remove hardcoded secrets, then platform hardening — each reviewable in isolation. - Use Case: Before launching a new tenant-facing feature, ask for a perimeter scan to confirm no table lacks RLS, no edge function trusts company_id from the request body, and no VITE_* variable exposes a service-role key. ## Quick Start Run a full security and RLS lint of my Supabase backend and report all P0 and P1 findings with proposed remediations.
