Database checks: Supabase, Firebase and Postgres

Reviews a Supabase project's row-level security policies, views and database functions to find data that anyone on the internet can read or change.

Reviews Supabase Storage buckets and their access policies to find private files that are public and files that any user can overwrite or delete.

Reviews Firebase security rules for Firestore, Realtime Database and Storage, plus Admin SDK keys and Cloud Functions, to find data that anyone can read or change.

Reviews how a project connects to its SQL database and whether the schema has the basic safeguards: a limited-rights user, encryption, connection pooling, indexes and constraints.

Reviews how a project changes its database structure: whether migrations exist, whether a pending one would destroy data, whether seed scripts could reach production, and whether development and production share a database.

Checks whether users can delete their account and get a copy of their data, and whether deletion really removes their personal data from every table, from file storage and from outside services.

Finds database queries that will slow down or fail as data and traffic grow: queries in loops, lists with no limit, filtering in app code, deep OFFSET paging, wildcard search and missing timeouts.

Finds places where data goes wrong when two requests arrive at once or a step fails halfway: balances and stock that lose updates, missing transactions, coupons used twice, unsafe retries, deleted rows that reappear and cascades that delete too much.

Finds database setup that breaks under real traffic and real deploys: pooler settings that crash queries, connection pools larger than the database allows, migrations that lock busy tables, raw database errors shown to users, no recovery from brief outages and stale replica reads.

All database checks, plus production checks that `/launch-check` does not run (see below). `/launch-database basic` skips them

Row-level security, views and database functions

Supabase Storage: private files that are public, files anyone can overwrite

Firestore, Realtime Database and Storage rules

Connection, user rights, encryption, pooling, indexes, constraints

Missing migrations, changes that would destroy data, seed scripts

Can users delete their account and get their data? Is everything removed?

Queries in loops, lists with no limit, filtering in code, deep paging, slow search, no query timeout

Balances and stock that lose updates, missing transactions, coupons used twice, unsafe retries, deleted data that comes back

Pooler settings that crash queries, too many connections, migrations that lock tables, raw database errors shown to users