Security Review of Vercel + Supabase Web App (Auth, RLS, API Routes)

I'm looking for an experienced security reviewer to audit a web application built on Next.js (hosted on Vercel) with Supabase as the backend (Postgres, Auth, Row Level Security). This is a B2B SaaS application handling multi-tenant data, so proper data isolation between accounts is critical. Scope of review: - Row Level Security (RLS) policy correctness, especially around multi-tenant data isolation - Authentication and session handling - API route authorization checks (are endpoints properly verifying user/tenant access before returning data?) - Environment variable handling (checking for any secrets or service role keys exposed client-side) - CORS configuration - Rate limiting on public-facing endpoints - General OWASP-style review of the app layer (injection risks, insecure direct object references, etc.)