Building Management System Development

Hi, I built a maintenance platform for property managers and I am about to put real client data on it. Before I do, I want an experienced pair of eyes on both the security and the general quality of the code. The app is React with TypeScript on the front and Supabase, so Postgres with Auth and Storage, on the back. It is multi tenant, so every client should only see their own data, and there is a private cost layer that clients must never reach. Access runs through row level security, database views and RPC functions, and private storage buckets. I already did a hardening pass myself and I have around 180 automated tests, including client isolation ones. Now I want someone independent to check it properly. What I am after: Security first. Auth, the RLS policies, storage rules, the SECURITY DEFINER functions and client facing views, and anything that lets one tenant reach another or reach the private cost layer. A general code review. Structure, obvious bugs, anything fragile that will bite me later. I want a written report with the findings ranked by how serious they are and how to fix each one. I can give read access to the code and a test environment with fake data. The codebase is compact, one operator and a couple of dozen tables, so think days not weeks. Thanks, Thomas.