Security & tenant-isolation audit for a multi-tenant Next.js + Firebase SaaS

We run a multi-tenant SaaS for employee attendance tracking. Organizations sign up, add their sites and staff, and employees clock in and out from a mobile app. Before onboarding more organizations, we want an independent audit of the backend focused on one question: can any user read or change data that belongs to another organization or site? Stack: Next.js frontend Firebase: Firestore, Cloud Functions (TypeScript), Firebase Authentication Role-based access using Auth custom claims, scoped per organization and per site Stripe per-seat subscription billing driven by webhooks Firestore transactions for clock-in/out sessions, plus rate limiting and server-side device fingerprinting In scope: Firestore security rules: tenant isolation between organizations and between sites, and role escalation (can an employee grant themselves admin?) Custom claims: how they are set and refreshed, and what happens when a user’s role or site changes Cloud Functions: authentication and authorization on every callable and HTTP function, and input validation Stripe webhooks: signature verification, idempotency, and whether seat counts can be manipulated Attendance sessions: whether concurrent or replayed clock-in events can create inconsistent data Next.js: secrets exposure in the client bundle, and server-side auth checks Deliverable: A written report where each finding includes severity, where it is, proof (a rule test or reproduction steps), a plain-language impact line, and a concrete fix. Firestore rules tests delivered as files we can rerun with the emulator. Access: read-only repository access after hire, with an NDA. No production access; testing happens against the Firebase Emulator Suite. Screening questions: What is the first thing you would check in our Firestore rules, and why? Describe one tenant-isolation or authorization issue you have found in a Firebase or Supabase app. What was it and how did you prove it? How would you test that a Stripe webhook handler is safe against replays and forged events? What will your report look like? A link to a redacted sample is welcome.