DEV Community

Cenk KURTOĞLU profile picture

Cenk KURTOĞLU

Supabase RLS audits. I find the cross-tenant leaks a linter cannot see: policy conflicts, unisolated membership joins, service-role key exposure. Read-only access or a sanitized schema dump is enough.

Work

Independent Next.js + Supabase reviewer and production bug-fix developer

You shipped a Supabase app with AI. Here are the 4 security holes it probably has (and the 5-minute fixes)

You shipped a Supabase app with AI. Here are the 4 security holes it probably has (and the 5-minute fixes)

Comments
5 min read

Want to connect with Cenk KURTOĞLU?

Create an account to connect with Cenk KURTOĞLU. You can also sign in below to proceed if you already have an account.

Already have an account? Sign in
New Row Violates Row-Level Security Policy: The Real Fix

New Row Violates Row-Level Security Policy: The Real Fix

Comments
4 min read
Supabase Storage Upload Fails With RLS (403: new row violates row-level security policy)

Supabase Storage Upload Fails With RLS (403: new row violates row-level security policy)

Comments
2 min read
Why Supabase RLS Returns Nothing or 42501 (auth.uid() Is Null on the Server)

Why Supabase RLS Returns Nothing or 42501 (auth.uid() Is Null on the Server)

Comments
3 min read
7 Ways Your Supabase App Still Leaks Data With RLS Enabled

7 Ways Your Supabase App Still Leaks Data With RLS Enabled

Comments
3 min read
Test your Supabase RLS before you ship: a free red/green fixture and the 9 SQL checks a linter cannot run

Test your Supabase RLS before you ship: a free red/green fixture and the 9 SQL checks a linter cannot run

Comments
4 min read
Your Supabase service_role key is probably in your browser bundle

Your Supabase service_role key is probably in your browser bundle

Comments
5 min read
Stripe doesn't support my country. Here's how you ship a paid product anyway (2026)

Stripe doesn't support my country. Here's how you ship a paid product anyway (2026)

Comments 1
2 min read
Two SQL queries that tell you whether your Supabase RLS is actually on

Two SQL queries that tell you whether your Supabase RLS is actually on

Comments
6 min read
Your Supabase service_role key is probably in your browser bundle

Your Supabase service_role key is probably in your browser bundle

Comments
5 min read
Your Supabase RLS policy passes every test and still leaks

Your Supabase RLS policy passes every test and still leaks

Comments
4 min read
I built an API-callable llms.txt generator after Lighthouse added an audit

I built an API-callable llms.txt generator after Lighthouse added an audit

Comments 1
2 min read
If Stripe is not available in your country, check this before rebuilding your SaaS billing

If Stripe is not available in your country, check this before rebuilding your SaaS billing

Comments
2 min read
I will review 5 Next.js SaaS landing/payment flows today

I will review 5 Next.js SaaS landing/payment flows today

Comments 1
2 min read
What 'Production-Ready' Actually Means for a Next.js Template (a Checklist)

What 'Production-Ready' Actually Means for a Next.js Template (a Checklist)

Comments
3 min read
Ship a Client Website in a Day: The Single-Config Pattern for Next.js

Ship a Client Website in a Day: The Single-Config Pattern for Next.js

Comments
3 min read
I Built 20 Production-Ready Next.js + Tailwind Templates — Here's the Architecture

I Built 20 Production-Ready Next.js + Tailwind Templates — Here's the Architecture

Comments
3 min read
How I Wire Polar MoR Payments In A Next.js SaaS Without Stripe

How I Wire Polar MoR Payments In A Next.js SaaS Without Stripe

Comments
3 min read
Next.js 15 App Router SEO done right: generateMetadata, dynamic sitemaps, and the one-file strategy

Next.js 15 App Router SEO done right: generateMetadata, dynamic sitemaps, and the one-file strategy

Comments
6 min read
23 Production-Ready Next.js 15 + Tailwind Templates (Live Demos You Can Click)

23 Production-Ready Next.js 15 + Tailwind Templates (Live Demos You Can Click)

Comments
2 min read
New Technical Article

New Technical Article

Comments
2 min read
Top 5 Modern Next.js SaaS Templates to Launch Your Startup in 2026

Top 5 Modern Next.js SaaS Templates to Launch Your Startup in 2026

Comments
2 min read
Untitled

Untitled

Comments
1 min read
Untitled

Untitled

Comments
1 min read
10 Best AI Tools for Shopify Store Owners in 2026

10 Best AI Tools for Shopify Store Owners in 2026

Comments
2 min read
Why Static Product Photos Are Killing Your Shopify Sales (And How to Fix It)

Why Static Product Photos Are Killing Your Shopify Sales (And How to Fix It)

Comments
2 min read
How I Automated My Shopify Store's Video Ads Using AI (And Increased Conversions by 40%)

How I Automated My Shopify Store's Video Ads Using AI (And Increased Conversions by 40%)

Comments
2 min read
How I add Polar (Merchant of Record) + Stripe to any Next.js app in 10 minutes — without an SDK

How I add Polar (Merchant of Record) + Stripe to any Next.js app in 10 minutes — without an SDK

1
Comments
2 min read
What 'production-ready' actually means for a Next.js template - a single-source-of-truth architecture

What 'production-ready' actually means for a Next.js template - a single-source-of-truth architecture

Comments
3 min read
Top 5 Modern Next.js SaaS Templates to Launch Your Startup in 2026

Top 5 Modern Next.js SaaS Templates to Launch Your Startup in 2026

Comments
2 min read
What "production-ready" actually means for a Next.js template — a single-source-of-truth architecture

What "production-ready" actually means for a Next.js template — a single-source-of-truth architecture

1
Comments
4 min read
How I add Polar (Merchant of Record) + Stripe to any Next.js app in 10 minutes — without an SDK

How I add Polar (Merchant of Record) + Stripe to any Next.js app in 10 minutes — without an SDK

Comments
3 min read
I built 20 production Next.js 15 templates: the stack, patterns, and lessons

I built 20 production Next.js 15 templates: the stack, patterns, and lessons

Comments
3 min read
loading...