Supabase RLS not working, or not on at all? How to check it, and I'll fix it.
In 48 hours I check every table and policy in your Supabase project, write and test the missing rules with two real accounts, fix your next two biggest problems, and send a written report and a video. $299, fixed price.
- Report, video and top 3 fixes in 48 hours
- Fewer than 3 real problems fixed? Full refund
- Collaborator access only, never your passwords
What it is, and why it matters
Row level security (RLS) is the set of rules in your Supabase database that decides which rows each signed-in user can read, add, change or delete. Your app's browser code talks to the database directly with a public key, so these rules are the only thing standing between one customer and another customer's data. AI builders often create tables with RLS off, or with a policy that lets any signed-in user see everything.
- Any visitor can open the browser's developer tools, copy the public key your app already ships, and read whole tables with it.
- One customer can see, change or delete another customer's records.
- A policy that says "authenticated users can do anything" looks like security in the dashboard but only stops people who haven't made a free account.
How I fix it
- Turn RLS on for every table that holds user or customer data, and write one policy per action (select, insert, update, delete) tied to the owner's user id or team.
- Move anything that must bypass the rules (admin jobs, webhooks) to server-side code with the service role key, never the browser.
- Test each policy with two accounts and write the result in the handoff document, so you can see what was checked.
A Launch Check includes this fix if it's one of your three biggest problems. Data anyone can read usually comes first.
What you get in 48 hours, for $299
A written report
All ten areas marked pass, warning or fail, what each failure means for your customers in plain words, and what it takes to fix.
A 10-minute video
Me walking through your app and the report, so you understand what I found without reading code.
The 3 biggest problems, fixed
Done in your repository as changes you approve, each with a short note on what changed and why.
A list of keys to rotate
Every secret that may have been exposed, where to rotate it, and in what order.
Client portal · Lovable + Supabase + Stripe
- FailDatabase rules: invoices table readable by any signed-in userFixed in your repo
- FailSecrets: OpenAI key in browser code, callable by anyoneFixed, key rotated
- FailPayments: Plan unlocked on the success page, not by a webhookFixed in your repo
- WarningBackups: Daily backups on, never restored, files not coveredIn the Sprint
- WarningSign-in emails: Sent from the default sender, links to old addressIn the Sprint
- PassYour domain: HTTPS on, one address, redirects correctPass
How it works
- 2 minutes
Pay $299
Card or wallet through Stripe. You get a receipt and the intake form straight away.
- 5 minutes
Give me access
Your app's address, and collaborator access to GitHub, Supabase and your hosting. Never passwords.
- Within 48 hours
Report, video, 3 fixes
I check all ten areas on your live app, fix the three most serious problems, and send the report and video.
- Your call
Stop there, or finish the job
Fix the rest yourself with the report, or book the 5-day Sprint with the $299 taken off.
You don't carry the risk
Launch Check: 3 real fixes, or your money back
If I can't find and fix at least three real problems in your app, you get the full $299 back. You keep the report.
Sprint: live in 5 working days, or your money back
If the Sprint isn't live in 5 working days from the day I have access, you get the full $1,090 back, and you keep everything I finished.
What I won't do is call your app "secure": nobody honestly can. You get, in writing, what I checked, what I fixed and what's still open. Refund policy.
Why not just ask the AI, or hire a freelancer?
| What matters | Launch Check with me | Ask the builder's AI | A report-only audit | Hire a freelancer |
|---|---|---|---|---|
| Problems fixed, not just listed | Top 3 fixed in 48 hours | Sometimes | No | Yes |
| Price known before you start | $299, fixed | Credits, until it works | Yes | Usually hourly |
| Checks your live database and Stripe, not just the code | Yes | No | Depends | Depends |
| Keeps your builder and your code | Yes, no rewrite | Yes | Yes | Often quotes a rewrite |
| Money back if it doesn't deliver | Yes | No | Rarely | Rarely |
Who you're hiring
I'm Max Zeshut, a full-stack developer. I build and run 16 live sites of my own, on Next.js, Postgres, DigitalOcean and Stripe, and I build with AI coding agents every day. I know how fast they get you to a demo, and exactly which parts they leave out. You deal with me from the first message to the last fix.
Some of the sites I run, live right now
- ppl.studioAI app: sign-in, Stripe billing, Postgres
- plana.weddingWedding planning tools with Stripe checkout
- advent.center1,100+ advent calendars reviewed and priced
- peptides.academyReference site with a dose calculator
- dupe.softwareSoftware sold once for $99
- gtasix.howGame companion guide with interactive tools
Start with a Launch Check
Start here
Launch Check
$299
One payment · results in 48 hours
- All ten areas checked on your live app
- Written report and a 10-minute video
- The 3 biggest problems fixed
- 3 real fixes, or your money back
Then, if you want it all done
Ship-it Sprint
$791 after your Check
$1,090 − $299 credit, booked within 14 days · 5 working days
- Everything on the list fixed: data rules, keys, payments, domain, email, backups, monitoring
- A handoff document a future developer can read
- Live in 5 working days, or your money back
3 of 3 Sprint slots open this week. What the Sprint covers
Prices in US dollars, paid securely through Stripe. App down or data leaking right now? Rescue, $490: I start within 24 hours.
Check your own app first
- In the Supabase dashboard, open Database, then Tables. Any table with "RLS disabled" next to it is readable by anyone who has your public key.
- Open Authentication, then Policies. For each table, read the policy in plain words: who does it let in, and to which rows? A policy using only
auth.role() = 'authenticated'ortruelets every signed-in user see every row. - Run the Security Advisor (Database, then Advisors). It lists tables without RLS and policies it thinks are risky.
- Make two test accounts in your own app. Sign in as the first, create something, then sign in as the second and see whether you can find it.
- If RLS is on and your app now shows empty lists or fails to save, the table has no policy for that action yet. That is RLS working as designed; it needs a policy, not to be switched off.
Only ever check an app you own or have written permission to test.
Found something you'd rather not fix yourself? Have me fix it, $299
Questions
Is the Supabase anon key in my code a leak?
No. The anon key is meant to be public. It is only safe when RLS is on and the policies are right, because that key plus a table with RLS off is enough to read the table.
Will turning RLS on break my app?
It will, for a moment: with RLS on and no policy, the table returns nothing. That is why I write and test the policies in the same change, on a copy first.
Is it safe to give you access?
You add me as a collaborator on GitHub, Supabase and your hosting, so you can see everything I do and remove me in one click. I never ask for passwords, I don't copy your customers' data anywhere, and when I'm done you get a list of keys to rotate.
What if you don't find much?
If I can't find and fix at least 3 real problems, you get the $299 back. You still keep the report, which shows what was checked and passed.
Will you rewrite my app or make me leave my builder?
No. I fix what's there, in your repository. You keep building in Lovable, Bolt or Replit afterwards, and the report tells you what not to undo.
Who does the work?
I do, myself, every check and every fix. That's why there are only three Sprint slots a week.
Is this a penetration test?
No. I check your app's setup against a fixed list, on your own accounts, and fix what fails. I don't attack your app or anyone else's, and I won't call it "secure": you get in writing what was checked, what was fixed and what's still open.
Where are you, and how fast do you reply?
I work from Europe (CET) and reply to email within a few hours on working days. The 48 hours of a Launch Check start when I have access; a Rescue starts within 24 hours, any day.
What happens after the Launch Check?
Nothing, unless you want it to. The report is yours to fix the rest yourself or with anyone. If you book the 5-day Sprint within 14 days, the $299 comes off its price.
Find out what your app is missing, in 48 hours
A Launch Check is $299: a written report, a video walkthrough and the three biggest problems fixed. Fewer than three real fixes and you get your money back. The full price comes off a Sprint booked within 14 days.