database-security

Database security auditor specialized in Row Level Security (RLS) enforcement, Zero-Trust database architecture, and forensic audit trails. Focuses on Supabase, Postgres, and Convex data layer security. For general application security (OWASP Top 10, auth patterns, security headers, input validation), use the security skill instead.

| RLS enforcement | Enable on every public table; separate policies per operation | | RLS performance | Index RLS columns; wrap auth.uid() in (select ...) subselect | | Zero-Trust DB | Micro-segmentation, identity propagation, TLS enforcement | | Supabase auth in RLS | Use (select auth.uid()) and auth.jwt(); never auth.role() |

| Convex auth guards | Call ctx.auth.getUserIdentity() in every public function | | JIT access | Time-bound grants that expire automatically | | Audit trails | Database triggers with immutable auditlog table | | PGAudit | Extension for statement-level and object-level SQL auditing | | Service role safety | Never use servicerole key in client-side code |