Next.js + Supabase SaaS to production: RLS, Stripe billing, hardening, AI features

We run a multi-tenant SaaS platform that is live with paying customers. It is built on Next.js, React, TypeScript, Node.js and Supabase (PostgreSQL), with Stripe for billing, and parts of the codebase were built quickly, including code generated with AI tools such as Cursor and Lovable. We are hiring a senior engineer to make the platform safe to charge money at scale, then build the next phase. The work runs in three phases. PHASE 1, WEEK 1: LAUNCH READINESS AUDIT • Review Supabase security (row-level security on every table, tested per role; exposed keys; storage rules), auth on our live domain, the Stripe billing flow, deployment and performance. • Deliver a severity-ranked report with the fix and an effort estimate for each finding. It sets the order of work for the rest of the contract. PHASE 2, WEEKS 2 TO 5: THE MONEY PATH AND PRODUCTION HARDENING • Stripe billing that stays correct: checkout, subscriptions, renewals, upgrades and downgrades, failed payments and cancellations, with signed, idempotent webhook handling and server-side entitlements that keep customer access in sync with Supabase. • Supabase row-level security, team roles and permissions, storage rules and migrations, so each customer sees only its own data. • Hardening: separate development and production environments, secrets out of code, error monitoring and structured logging, backups, CI with preview deployments and a staging environment, and automated tests for billing, authentication and permissions. • Fix the most urgent existing problems: bugs, slow pages, large JavaScript bundles and silent errors, including code generated with AI tools. PHASE 3, FROM WEEK 6: FEATURES AND AI • Build or finish core product features in Next.js and TypeScript: multi-tenant dashboards and the next customer-facing features on our roadmap. • AI features using the OpenAI, Claude or Gemini APIs, starting with smart customer support and content processing, with cost limits, retries and fallbacks. DELIVERABLES • The phase 1 audit report with test output. • Working features shipped to staging, then to production on Vercel or AWS. • Automated tests for billing, authentication and permissions, and a short runbook for billing and access. • Short written notes for each milestone: what changed and how to run it. • All code in our Git repository, reviewed through pull requests, with a full handover at the end. HOW WE WILL WORK • Hourly contract, more than 30 hours per week, for 3 to 6 months, with the possibility of a longer-term role. • A weekly check-in with a demo on staging. • Engineering standards: TypeScript in strict mode; CI with preview deployments and a separate staging environment; error monitoring and structured logging in production; secrets kept out of code; least-privilege database access and row-level security on every table; Core Web Vitals in the green and small JavaScript bundles. REQUIREMENTS • Production experience with Next.js (App Router), React, TypeScript and Node.js on apps with paying users. • Hands-on Supabase: Postgres schema design, row-level security, auth, storage rules and migrations. • Stripe billing in production: subscriptions, proration, signed webhooks, idempotent event handling and entitlement sync with the database. • Experience taking inherited or AI-generated code to production without a rewrite. • Shipped LLM features with OpenAI, Claude or Gemini, including cost limits, retries and fallbacks. • Clear written English and a weekly video call. To apply, describe one Next.js + Supabase or Stripe app you took to production or fixed, the measurable result, and what you would audit first in ours.