Supabase/Lovable Security Specialist — RLS Hardening for App Handling Student PII

**Overview** We run an education company with an app built on Lovable (React + Supabase/Postgres) that handles university student data. We need an experienced security engineer to audit and harden it so it can pass university vendor security reviews (FERPA / GDPR / POPIA contexts). This is hands-on remediation work, not a written report. **What you'll do** - Audit Row Level Security (RLS) across all Postgres tables and Supabase Storage buckets, and identify every place student PII is exposed (especially via the anon/public key) - Write and test per-operation RLS policies (select/insert/update/delete) with proper using + with check clauses - Verify role-based access is tamper-resistant (no privilege escalation via self-editable role columns) - Confirm the service-role key is server-side only and move any privileged operations into Supabase Edge Functions - Lock down Storage buckets holding student documents - Deliver a repeatable test procedure (curl/SQL) we can re-run after every app change **You must have** - Demonstrable Supabase + Postgres RLS experience (please cite specific projects) - Familiarity with Lovable or similar AI app builders and their common security gaps - Understanding of how client-side React apps expose keys and data - Bonus: experience with FERPA/GDPR/POPIA or university/edtech vendor reviews **To apply** In your first line, tell me the single most common RLS misconfiguration you find in AI-generated Supabase apps and how you test for it. Generic proposals will be ignored. **Scope:** Fixed-price for initial audit + remediation, with potential for ongoing retainer as we add features. Please include an estimate of hours and your approach.