payment received

Thanks! Here's what happens now.

Stripe has emailed your receipt.

1
I'll email your checkout address within a business day.
I'll never ask for passwords, keys or logins. Please don't send any, even if it seems easier.
2
Book a 30-minute call (recommended)
We'll discuss who should see what in your product. No prep required.
Book the call
Rather skip the call? Just reply to my email.
3
You get your report
A short written report, in plain language. It arrives within 3 business days of getting access.
It includes:
- A summary of how exposed you are, in a few sentences.
- Every problem I find, ranked from most to least risky: what's exposed, and who could see or change it.
- The fix for each one, written so you or your devs can apply it.
- What's already set up well, so nobody breaks it by accident.

When your report is done, I delete everything you shared with me. I keep only general lessons, never anything about you or your app.

For your developer: ways to give me access

Pick one, least access first. Remove my access once the report arrives.

A schema export, shared from your own drive
Export your schema with the commands below. Then share the file from your own Google Drive or Dropbox with my email address only, not "anyone with the link". Please don't email it: a shared file stays under your control, and you can take it back.
```
supabase link
supabase db dump --linked -f schema.sql
```
What this shares: The least. One file with your tables and rules, no data, nothing live. It leaves out storage bucket rules, so describe those in your reply.
Read access to your code repository
If your rules live in your repository (with the Supabase CLI, they're in supabase/migrations), add me with GitHub's Read role.
What this shares: I can read all the code in that repository and its history, not just the rules. Check nothing secret was ever committed to it.
A read-only invite
Invite me to the project with Supabase's Read-Only role. It's only on the Team and Enterprise plans.
What this shares: I can read your data, including user records and stored files, but can't change anything. Safest on a copy of production without real data.
A developer invite, on a copy
Invite me as a Developer to a project that copies production's structure and rules but holds no production data.
What this shares: I can change things in that project. Never use this on production itself, only on a copy without real data.

I'll email your checkout address within a business day.