Senior Code & Architecture Review — Next.js + Supabase Marketplace App (Report Only)

Description: I'm looking for a senior full-stack engineer to do a one-time review of a B2B marketplace platform I've built. This is a report-only engagement — no rebuilding, no ongoing work, just a clear written assessment of where things stand. The platform has two parts: 1. Internal operations dashboard (internal.msaha.sa) Next.js 14 (App Router), TypeScript, Supabase (PostgreSQL, RLS, Edge Functions, Storage), deployed on Vercel. Used daily by a small internal team. Features include lead management, a Kanban pipeline, match-making workflows, document storage, meeting scheduling, and quotation generation. 2. Public website (msaha.sa) Static HTML/CSS/JS, deployed on Netlify. Includes a kitchen browsing page that pulls live listings from Supabase, and lead capture forms that write to Supabase via Edge Functions. Both share the same Supabase backend. What I want from you: A written report covering: Code quality — is it maintainable, readable, consistent? Architecture — is the structure sound for a growing marketplace? Any decisions that will cause pain at scale? Database design — schema, relationships, indexing, anything that looks problematic Security — RLS policies, exposed data, auth setup, Edge Function hygiene Honest summary — what's solid, what needs attention, what's a real risk vs a minor improvement What I don't want: A proposal to rebuild anything Vague observations without reasoning A list of every minor style preference I want to know if this is built on a solid foundation or if there are structural problems I should fix before onboarding real users. Budget: $200–400 fixed price Timeline: Report delivered within 7 days of access being granted Experience required: Strong Next.js and Supabase experience (not just familiarity) Has worked on multi-tenant SaaS or marketplace products Can assess PostgreSQL RLS policies specifically Comfortable reviewing TypeScript codebases To apply, tell me briefly: what's one common mistake you see in Supabase RLS setups, and what's your process for reviewing an unfamiliar codebase?