qa-advisors

name

qa-advisors

description

QA audit running Supabase's built-in security + performance advisors (whole-DB lints) against superledger-app prod. Catches new RLS gaps, exposed/SECURITY DEFINER objects, missing FK indexes, and auth misconfig that the per-feature QA skills miss — they check the diff, this scans the whole live schema. Use when the user asks to run advisors / DB lints, or when qa-weekly invokes it. Prod: ugjulsrvvsrlzyaiitdh.

QA — Supabase Advisors (security + performance lints)

Your CI gates check the diff; this scans the whole live DB for drift. This is the standing guard for the recurring RLS/anon-bypass incident class (anon bypass, dropped RLS policies, REVOKE-insufficient). Read-only.

Run

Call the Supabase MCP advisors tool for BOTH types (project ugjulsrvvsrlzyaiitdh):

• mcp__a583a0c2-fc45-40e4-97fa-eee2aec8c0f0__get_advisors with type: "security"
• same tool with type: "performance"

(If the MCP advisors tool isn't available, SKIP with that reason — do not hand-roll.)

Triage

Security advisors — these are the ones that matter most here:

• rls_disabled_in_public / RLS-disabled on a table exposed to anon/authenticated → FAIL (this is the exact anon-bypass class that's bitten before).
• security_definer_view / function search_path mutable / exposed auth → FAIL, name the object.
• policy_exists_rls_disabled, rls_enabled_no_policy → FAIL.
• Anything new vs. the last run → surface.

Performance advisors — advisory, not blocking:

• , , → note as , list top offenders. Don't FAIL the suite on perf lints alone.