For multi-tenant apps, RLS is enabled is not evidence that rows are isolated. The failure I keep looking for is simple: user A can read or mutate a row owned by tenant B through a permissive relationship or missing ownership condition.
I built a tiny red/green fixture around that exact case. The broken policy fails the cross-tenant assertion; the one-file fix passes the same test suite. It runs locally without a Supabase project, credentials, Docker, or production data:
https://github.com/cekuu35/supab...
My current minimum proof is: same-tenant access succeeds, cross-tenant read returns zero rows, cross-tenant write changes zero rows, and the assertions run under the application role rather than an admin role.
A tiny, runnable Supabase/Postgres security fixture that proves a policy can look correct and still leak rows across tenants. The same test suite runs red on the broken policy and green after the one-file fix. Start with npm ci && npm test—no Docker, cloud project, credentials, or production data required. Built for founders and developers who want evidence before shipping multi-tenant apps.
I sell Next.js website templates, and the thing that annoyed me most as a buyer in that market is that you usually cannot see the product before you pay. You get three screenshots and a promise. So every one of my 20 templates is deployed and browsable, free, right now: https://cenkkurtoglu.com/templates Every card there has a live demo link to the deployed site. Click through, open the sub-pages, resize the window. If they are not what you want, you have lost two minutes instead of $79. What they are: 20 multi-page starters, one per niche (SaaS, agency, e-commerce, real estate, restaurant, gym, dental clinic, hotel, law firm, course platform and ten more). Next.js 15.1, React 19, Tailwind 3.4, 5-8 pages each, editable TypeScript source, commercial licence for client work. What they are not, stated plainly because I would rather lose a sale than an argument later: these are frontend starters, not full-stack SaaS boilerplates. Forms, cart, booking, auth and checkout are demo UI. You replace the placeholder content and wire your own backend. If you need auth and payments already working, buy a boilerplate instead, not this. One bundle, all 20, $79 one-time. It is on Product Hunt tomorrow morning. I am not going to ask anyone here for anything on launch day, but if you have used template bundles before I would genuinely like to know: what made you regret a purchase? I would rather fix it before someone pays than after.
