supabase-security / Oct 30

Thanks. Let’s get your project ready for Oct 30.

Stripe has emailed your receipt (it shows Rotate Pilot, our parent company). One email from you starts the work.

  1. Send us what we need to start

    • The repoThe GitHub repo with your supabase/migrations folder, or the app repo if you don’t use migrations yet.
    • Access, one of two waysInvite GitHub user Perufitlife as a collaborator (Write lets us open the pull request; we never push to your main branch or merge). Or create a fine-grained, read-only token for that repo, set to expire in 30 days, and send it in a separate email.
    • Your Supabase project refThe part before .supabase.co in your project URL. We don’t need your service_role key or database password.
    Email the start details

    Opens your email app with a checklist filled in. Or write to renzomacar@gmail.com and use the email address you paid with.

  2. We confirm access and start the clock

    We reply within one business day to confirm we can see the repo and the project. Your delivery time counts from the moment access works.

  3. Your pull request arrives within 48 hours

    Least-privilege grants for every table, view, sequence and RPC function your app reaches, row level security checked on each one, verified by replaying your migrations on a clean database and calling the API as anon and as a signed-in user, plus the CI check. You review, merge and deploy it the usual way.

  4. After you merge

    The CI check fails any future migration that adds a table without grants, so the fix holds after Oct 30. Questions on the pull request? Reply on it or by email.

Your guarantee. If a table covered by our pull request can’t be reached through the Data API after Oct 30, we fix it free. If the deliverable is late against the time on your plan, counted from when access works, you get a full refund.