Supabase Row-Level Security (RLS) review for a property management web app

I built a property management SaaS using Lovable (React + Supabase). Before onboarding real users and enabling online rent payments, I need a focused SECURITY REVIEW — not a rewrite. Scope: - Audit all Supabase Row-Level Security (RLS) policies to confirm strict data isolation between: (1) tenants and managers, (2) different tenants, and (3) different organizations (multi-tenant). - Check storage bucket policies so uploaded photos/documents can't be accessed by other users. - Confirm no sensitive keys (service_role) are exposed client-side. Deliverable: a list of any vulnerabilities found, ranked by severity, with the specific fixes. Estimated 2-4 hours. I will give read access to the GitHub repo. Please reply with: 1. Your specific experience with Supabase Row-Level Security (RLS). 2. Your availability this week. 3. One example of a security issue you commonly find in Supabase apps.