Building Management System Development

Hi, I built a maintenance platform for property managers and I am about to put real client data on it. Before I do, I want an experienced pair of eyes on both the security and the general quality of the code. The stack is Vite, React 18 and TypeScript on the front, with shadcn/ui and Tailwind. The backend is Supabase, so Postgres with Auth and Storage, plus a few edge functions for email through Resend. The database runs on SQL migrations and there is a Vitest test suite including client isolation tests. The app is multi tenant, so every client should only see their own data, and there is a private cost layer that clients must never reach. Access runs through row level security, database views and RPC functions, and private storage buckets. I already did a hardening pass myself and I have around 180 automated tests. Now I want someone independent to check it properly. What I am after: Security first. Auth, the RLS policies, storage rules, the SECURITY DEFINER functions and client facing views, and anything that lets one tenant reach another or reach the private cost layer. A general code review. Structure, obvious bugs, anything fragile that will bite me later. The codebase is compact, one operator and a couple of dozen tables, so think days not weeks. Thanks, Thomas