Fedi A.

I review multi-tenant SaaS applications for the failures that expose one customer’s data to another: broken tenant isolation, PostgreSQL row-level security gaps, weak session and token handling, and APIs that trust the client. What I review: • PostgreSQL RLS: FORCE RLS, SECURITY DEFINER functions, grants, role and privilege boundaries • How a signed-in session becomes a tenant context in the database, including connection pooling and revocation • Authentication: OIDC/OAuth, sessions, MFA, invitations and roles • APIs and backends (NestJS/Node.js/TypeScript, Supabase, Next.js): object-level authorization and cross-tenant access • Cloud setup and secrets: AWS, Docker, GitHub Actions How I work: • Evidence first: every finding references the exact code, SQL object or request, with reproduction steps • Targeted fixes, not rewrites or generic checklists • A verification matrix of negative tests your team can automate, plus a retest after you fix Background: Certified Kubernetes Administrator (CKA), security assessments on AWS, and incident response for a supply-chain compromise across 266 repositories.