skills.rest
chriso789
chriso789COMMUNITY
Explore all skills by this author →
GitHub

tenant-isolation-auditor

Audits multi-tenant SaaS for cross-tenant data leaks across schema, RLS, storage, and integrations.

Updated Sep 24, 2025
Search Tags:#multi-tenant#rls#security audit#supabase#saas#tenant isolation#data leak
One-click install
npx skills add https://github.com/chriso789/pitch-1 --skill tenant-isolation-auditor-chriso789
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: tenant-isolation-auditor
Source: https://github.com/chriso789/pitch-1/tree/main/.agents/skills/tenant-isolation-auditor
Command: npx skills add https://github.com/chriso789/pitch-1 --skill tenant-isolation-auditor-chriso789

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Multi-tenant white-label SaaS platforms risk catastrophic cross-company data leaks where one company can see another's contacts, jobs, invoices, or messages. This Skill systematically audits every layer of tenant isolation before any work is signed off. ## Core Features & Use Cases - Six-Gate Audit: Checks schema tenant columns, RLS policies, storage path prefixes, Telnyx number routing, integration credential scoping, and code-level cross-tenant query risks. - Hard Refusal Rules: Blocks sign-off on USING (true) policies, service-role queries without tenant filters, and frontend queries bypassing tenant resolution. - Structured Report Output: Produces a gate-by-gate PASS/FAIL report with hard fails, minimal-diff fixes, and auditable master-role exceptions. - Use Case: Before merging a new invoicing feature in a Supabase-backed CRM, run the auditor to verify the new tables have tenant_id columns, RLS policies filter by tenant, and edge functions resolve tenant from auth.uid() rather than request bodies. ## Quick Start Audit the current Supabase schema, RLS policies, storage buckets, and edge functions for cross-tenant data leak risks and produce the six-gate report.

Frequently Asked Questions about tenant-isolation-auditor

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I audit Supabase RLS policies for tenant isolation?▼

Query pg_policies for policies whose qual or with_check clauses do not reference tenant_id, company_id, or organization_id, and check pg_tables for tables with rowsecurity disabled. Any tenant-owned table with USING (true) or missing per-command policies is a hard fail.

How to prevent cross-tenant data leaks in multi-tenant SaaS?▼

Enforce tenant_id columns on every company-owned table, resolve tenant from auth.uid() via a SECURITY DEFINER membership function, prefix storage paths with tenant_id, and add explicit .eq('tenant_id', ...) filters on every service-role query.

Why is using service role keys dangerous in Supabase edge functions?▼

The service role bypasses Row Level Security entirely, so any query without a manual tenant filter can read or write every tenant's data. Every service-role query must include an explicit tenant_id equality filter with no exceptions.

Can webhook handlers trust tenant_id from the request body?▼

No. Client-controlled fields like request bodies, query strings, and JWT custom claims must never determine tenant scope. Resolve the tenant by looking up provider identifiers, such as a Telnyx to_number, in a server-side mapping table.

What are the limitations of RLS-only tenant isolation?▼

RLS does not protect service-role queries, storage objects without folder-based policies, or edge functions that construct queries dynamically. Defense in depth requires schema constraints, storage path prefixes, and code-level tenant filters alongside RLS.

Related Skills

Explore More Software Engineering Skills→
JaveedIshaqJaveedIshaq
1

database-migration-manager

Generate idempotent Supabase database migrations with RLS policies and storage buckets.

Community
Advanced
coreymaypraycoreymaypray
1

backend-architect

Automate Supabase backend architecture tasks including schema design, RLS policies, edge functions, and migrations.

Community
Advanced
BruceTyndallBruceTyndall

db-inspector

Audit Supabase schemas, RLS policies, and migration integrity.

Community
Advanced
dadbodgeoffdadbodgeoff
783

multi-tenancy

Implement multi-tenant architecture with tenant isolation and automated query scoping.

Community
Advanced