Description
Summary Senior PostgreSQL security review: RLS and append-only ledger audit (8-16 hrs, read-only) I am building an SaaS for Finnish micro-companies (TypeScript/Bun monorepo, Next.js, PostgreSQL on Supabase). The foundation is complete and I have committed to a hard gate: nothing gets built on top until an external senior engineer has validated it. What you would review (read-only, no code writing): - Append-only event ledger: hash chain, immutability triggers, column-to-JSON binding constraints - Multi-tenant isolation: RLS policies, SECURITY DEFINER scope functions, force-RLS coverage - Production DB roles: least-privilege grants, connection role, pooler compatibility - Approval chain: state machine enforcing human approval (GDPR Article 22) at DB level How this works: a complete evidence-based checklist is waiting in the repo. Every question is answered by running code or reading the exact line that enforces an invariant, not by opinion. The doctrine under test: every critical invariant must exist in two layers (application plus DB constraint or grant), and your job is to prove both layers are actually there. You will get read-only repo access, a local dev environment that spins up with one command, and the checklist document. Deliverable: written findings against the provided gate template, pass or fail per invariant, plus anything else you find. Optional extension: if the review goes well, I would value your design opinion on one remaining architectural decision (moving raw INSERT grants behind a single SECURITY DEFINER gateway), quoted separately. Practicalities: 8-16 hours total, async-first (written findings over meetings, one kickoff call optional), start within 2 weeks. English or Finnish both work. In your proposal, briefly describe your hands-on experience with Postgres RLS or ledger-style schemas. That is the main thing I will screen for.