# Luca Gennaro

> Luca Gennaro is an independent tech lead for Next.js and Supabase. He does fixed-price security reviews (RLS audits) for apps built with AI tools such as Lovable, Bolt, v0 or Cursor on Supabase. He finds database rules that let one customer see or change another customer's data, and fixes them. Written report, everything by email, no calls, no subscriptions. He is not a certified penetration tester: he offers careful, reproducible checks with evidence clients can rerun.

## Supabase security review (for founders)

- What is checked: database rules (Row Level Security) and permissions; which company's data each user can see; file storage and uploads; server functions; exposed keys and invite flows.
- Prices, one-time and fixed (USD):
  - Audit + written report: $150
  - Audit + fixes for critical and high issues, each checked with a test: $350
  - Full hardening (every issue fixed, automated isolation tests, documentation): $700
  - Bigger apps: fixed quote after reading the code.
- How the work is done: written permission first; testing on a local copy built from the client's code and migrations, with test accounts, never on real user data; every fix comes with a test.

## Public case study

- [agency-client-hub](https://github.com/luca-gennaro/agency-client-hub): a demo CRM built with Lovable on Supabase (not a client), reviewed as a client app before launch. Result: 4 confirmed issues and 1 high, latent finding (company data stayed separate only by accident), closed by 1 hardening migration and verified by 30 automated tests run as real users.
- [REPORT.md](https://github.com/luca-gennaro/agency-client-hub/blob/main/REPORT.md): the report, for founders first, developers second.
- [security/EVIDENCE.md](https://github.com/luca-gennaro/agency-client-hub/blob/main/security/EVIDENCE.md): request-by-request evidence.

## FAQ

- **What is RLS, and why does it matter?** Row Level Security (RLS) is the set of database rules in Supabase that decides which rows each signed-in user can read or change. When many customers share the same tables, one missing or loose rule can let one customer see or change another customer’s data. Nothing looks broken when that happens, so it takes a careful look to find it.
- **Do you work on my production database?** No. I only test with your written permission, on a local copy built from your code and migrations, with test accounts. I never touch your users’ real data, and I never test a live system without your permission.
- **What do you need from me?** Access to the code, including the Supabase migrations (a GitHub repository is easiest), a few lines on who your users are and what each role should be able to do, and your written permission. Everything happens by email.
- **How long does it take?** For a typical app, the report arrives within 5 working days of getting access to the code. Fixes add 3–5 working days. For bigger apps, I confirm the date in writing before I start.
- **What do I get?** A written report for founders first, developers second: each finding with its severity, what it means for your business and the evidence to reproduce it. With the fix packages you also get the fixes as a database migration, each one checked with a test you can rerun.
- **And if you don’t find any problems?** Then the report says so, and shows what I checked and how, with tests you can rerun yourself. It is careful, reproducible work, not a guarantee that nothing else can go wrong: I am not a certified penetration tester.

## Also: AI guest assistant for B&Bs and small hotels in Italy

- A chat widget for the property's website that answers guest questions (check-in, parking, breakfast, directions, house rules) in Italian, English, German, French and more.
- €390 one-time for the first property; each additional property + €100–150. The owner pays their own AI usage directly, usually a few euros a month. Free preview with the property's own information before deciding.

## Contact

- Written only, no calls: email hello@lucagennaro.com (security reviews, international), ciao@lucagennaro.com (B&Bs and small hotels in Italy, in Italian) or use the contact form at https://lucagennaro.com/#contact (replies by email, usually within a couple of working days)
- [Website](https://lucagennaro.com/)
- [GitHub](https://github.com/luca-gennaro)
- [LinkedIn](https://www.linkedin.com/in/luca-gennaro)
- [Privacy notice](https://lucagennaro.com/privacy): the contact form stores nothing on the site; no cookies, no tracking.
- [security.txt](https://lucagennaro.com/.well-known/security.txt): to report a security problem with this site, write to hello@lucagennaro.com.