Security Audit + Pen Test of AI-Built Supabase/React Portal

I have a private affiliate portal (admin + affiliate logins) that tracks clicks, conversions, and commissions. The whole thing was built with AI (Claude Code). It works, but we already found several real security breaches ourselves wrong people able to see data they shouldn't. I need a real expert to go through the entire app, hack it like an attacker would, fix what's found, and prove it's secure. What it's built with: The website: React with TypeScript (the affiliate/admin dashboard pages) The database and backend: Supabase — that's a Postgres database where the security rules (Row-Level Security) decide who can see what, plus server functions written in TypeScript, and login/auth all handled by Supabase Connections: it pulls conversion data from an affiliate network API. If you don't have real, hands-on Supabase security experience (RLS policies, grants, views, edge functions), this job is not for you. What you'll do: Audit the entire app — every database rule, every server function, every screen — for data leaks and broken access control. #1 concern: affiliates must never be able to see the network revenue numbers, through any screen, export, API call, or dev-tools trick. Pen test it as a logged-out visitor and as a logged-in affiliate trying to see other people's data or become admin. Test the API directly, not just the UI. Fix everything properly real fixes at the database/server level, not patches. All changes as reviewable migrations and commits. Nothing deploys without my approval. Give me a short written report: each issue, how you proved it, how you fixed it, and a re-test showing it's closed. In your own words, tell me: One specific Supabase/RLS data-leak you personally found and fixed (2–3 sentences) How you'd test whether an affiliate can see admin-only data