Part-Time Next.js + Supabase Engineer (Fixes and Hardening)

We run a live platform for Australian disability support providers covering rostering, participant records, worker credentials, incidents and billing in one product. It's built on Next.js (App Router), TypeScript, Supabase (Postgres, Row Level Security, Edge Functions, Auth) and Vercel. We already have a security tester and a QA engineer finding and reproducing issues. We need the engineer who fixes them. You'll take findings from a written report, write the fix in a branch, add a test that proves it, and open a pull request that passes CI before it ships. Most work will be RLS policies, API route authorisation, server actions, Postgres functions and migrations, error handling, and performance on slow pages. You'll work in a non-production environment only: a GitHub branch and a Supabase dev branch, with no production keys or live participant data. Every change goes through pull request review. You must have shipped a production Next.js app on Supabase, written and debugged RLS policies, and worked in a repo with CI and required checks. Please include a link to a Next.js + Supabase project you've built, and one sentence on the hardest RLS bug you've fixed. Proposals without both won't be read. This is part-time, about 10 hours a week to start, billed hourly through Upwork. The first piece is a paid trial: fix two issues from our current findings list, capped at 8 hours.