Application Security Specialist for SaaS

Security review / penetration test for a live SaaS web app I'm looking for an application security specialist to do a focused penetration test on a live web app before we onboard real users. The stack: React frontend, Supabase (Postgres) backend with Row Level Security as the primary access control, and serverless edge functions (some using service-role access). The app runs on the Anthropic API. The app handles sensitive personal data, private user reflections, so the most important thing to test is confidentiality: that no user can access another user's data, and that organization admins only ever see de-identified aggregate data, never individual private entries. I also want the RLS policies, the service-role functions, and the authentication/access flow tested. I'm looking for: Manual, attacker-driven testing, not just automated scans Hands-on Supabase / Postgres RLS experience A clear written report with severity, reproduction steps, and remediation guidance a non-technical founder can act on Willingness to sign an NDA and a defined scope of work Please include a redacted sample report from past work and a rough estimate of hours and timeline. Experience with multi-tenant SaaS and sensitive-data applications is a strong plus.