Senior Next.js + Supabase reviewer: audit an AI-built multi-tenant SaaS

We're a German B2B SaaS for gyms, live with our first customers and about to onboard 10 test gyms in November. Almost all of the code was written with AI coding agents. It has never had a human senior review. We've run two in-depth internal audits: a code audit with about 90 prioritised findings and a load test at 20 and 50 gyms. Now we want an experienced engineer to check those audits, find what they missed and sign off in writing. STACK - Next.js 15.5 (App Router, Server Actions, middleware), React 19, TypeScript, Tailwind 4 - Supabase Postgres + Auth: multi-tenant, RLS on every tenant table (~280 tables), 300+ SQL migrations, some direct Postgres access next to supabase-js - Vercel (Frankfurt), Vercel Cron driving a once-a-minute job worker and a message outbox - Integrations: Twilio (SMS), Brevo (email), Anthropic API (AI assistant with tool use), ElevenLabs (voice agent + webhooks), a gym ERP API, Meta Conversions API, Google OAuth - Vitest, including database tests - Roughly 300k lines of TypeScript. Nobody can read all of that in 20 hours, so we expect a risk-based review, not a line-by-line one WHAT YOU'LL DO (fixed price, 10-20 h) 1. Read our two audit reports. For each P0/P1 finding, tell us: agree / disagree / wrong severity, plus the fix you'd recommend 2. Review tenant isolation independently: RLS policies, SECURITY DEFINER functions, service-role / direct DB usage, how tenant context is resolved in server code 3. Review auth and permissions: login, MFA/passkeys, role checks at the database level vs only in the UI 4. Review the worker, outbox and webhooks: idempotency, timeouts, retries, double sends, silent failures, alerting 5. List anything important the audits missed 6. Write a sign-off: what has to be fixed before 10 gyms, what before 50, and whether you'd be comfortable maintaining this codebase Deliverable: one written report (Markdown or PDF) plus a 30-min call to walk us through it. You don't write code in this contract. Recommendations and short code snippets are welcome. Suggested milestones: (1) audit triage + tenancy/auth review, (2) worker/integrations + final sign-off. CONSTRAINTS (non-negotiable) - EU-based (GDPR). We will ask where you work from - Read-only repo access only. No production access, no database credentials, no member or customer data, ever. You work against local Supabase with seed data - NDA before access OPTIONAL AFTER A monthly retainer of EUR 300-600 for reviewing PRs before releases (around 4-8 h/month), if the first contract goes well. WHO WE WANT - Senior engineer with real production Postgres/Supabase multi-tenant experience. RLS is not new to you - You've reviewed codebases you didn't write, and you can explain risk clearly to a non-technical founder - Background-job / messaging-system experience is a strong plus - German is a plus, not required (parts of the UI and docs are German) TO APPLY Start your proposal with the word "tenant" so we know you read this. Answer the screening questions briefly and concretely. Generic or AI-written cover letters will be skipped.