Cenk KURTOĞLU

Security reviewer for AI-built Supabase apps. I find the leaks a linter cannot see: cross-tenant policy conflicts, unisolated joins, service-role key exposure, write-without-read holes.

Joined on Jun 21, 2026 https://cenkkurtoglu.com/supabase-rls-security-audit

Work

Independent Next.js + Supabase reviewer and production bug-fix developer

Pinned

Cenk KURTOĞLU

Aug 7

Before You Pay for a Next.js or Supabase Bug Fix, Capture These 6 Signals

#nextjs #supabase #debugging #webdev

3 min read

Cenk KURTOĞLU

Oct 21

I re-verified 30 disclosed Supabase keys. 20% were still live.

#supabase #security #database #webdev

3 min read

Want to connect with Cenk KURTOĞLU?

Create an account to connect with Cenk KURTOĞLU. You can also sign in below to proceed if you already have an account.

Create Account

Already have an account? Sign in

Cenk KURTOĞLU

Oct 21

RLS is on, so why can another user see my data? 7 Supabase surfaces that leak anyway

#supabase #security #postgres #webdev

4 min read

Cenk KURTOĞLU

Oct 21

The Supabase Security Checklist to Run Before You Launch

#supabase #security #startup #webdev

6 min read

Cenk KURTOĞLU

Oct 21

NEXT_PUBLIC_ and Supabase: Which Env Variables Are Safe to Expose?

#supabase #nextjs #security #webdev

5 min read

Cenk KURTOĞLU

Oct 21

You Committed .env to GitHub: What to Rotate (Supabase + Next.js)

#supabase #nextjs #security #postgres

6 min read

Cenk KURTOĞLU

Oct 21

Test Your Supabase RLS Policies Locally: A Free SQL Harness

#supabase #postgres #security #testing

5 min read

Cenk KURTOĞLU

Oct 21

Supabase RLS with auth.uid() not working? Causes and fixes

#supabase #postgres #security #webdev

6 min read

Cenk KURTOĞLU

Oct 21

Is my Supabase anon key exposed? What's actually safe (and what isn't)

#supabase #postgres #security #webdev

5 min read

Cenk KURTOĞLU

Oct 21

Why Your 3D Model Won't Open on iPhone — and the No-Install GLB to USDZ Fix

#webdev #ios #3d #ar

3 min read

Cenk KURTOĞLU

Oct 20

MCP configs are the new .env files — I found live database keys committed on GitHub

#claude #cybersecurity #github #security

4 min read

Cenk KURTOĞLU

Oct 20

GLB to USDZ in the Browser: How It Works and Why Your Files Never Leave Your Machine

#webdev #3d #threejs #tutorial

4 min read

Cenk KURTOĞLU

Oct 20

How I Audit Supabase Row Level Security in Client-Side Apps

#supabase #security #rowlevelsecurity #postgres

4 min read

Cenk KURTOĞLU

Oct 20

From GitHub Issue Mining to Paid Security Retainers

#security #freelancing #leadgeneration #supabase

3 min read

Cenk KURTOĞLU

Oct 20

Stop Losing 3 Hours a Day to Copy-Paste Work

#n8n #automation #openai #productivity

8 min read

Cenk KURTOĞLU

Oct 20

Building an SEO Content System That Feeds a Solo Product Funnel

#seo #contentmarketing #solodeveloper #productfunnel

4 min read

Cenk KURTOĞLU

Oct 20

Supabase RLS Mistakes That Leak User Data

#supabase #postgres #security #rowlevelsecurity

5 min read

Cenk KURTOĞLU

Oct 20

Finding Exposed API Keys in Shipped Apps Responsibly

#security #apikeys #responsibledisclosur #mobilesecurity

4 min read

Cenk KURTOĞLU

Oct 20

Finding Exposed API Keys in Shipped Apps Without Being a Jerk

#security #apikeys #responsibledisclosur #appsec

4 min read

Cenk KURTOĞLU

Oct 19

Supabase RLS breaking change (Oct 30, 2026): 5-minute check to avoid 42501 errors

#supabase #postgres #security #webdev

2 min read

Cenk KURTOĞLU

Oct 18

Supabase RLS Not Working? Fix It by Symptom

#supabase #postgres #rls #security

2 min read

Cenk KURTOĞLU

Oct 18

RLS Write-Leak: The Silent Data Exposure That Lets Any User Modify Any Row

#supabase #postgres #rls #security

3 min read

Cenk KURTOĞLU

Oct 18

4 Security Holes Your AI-Generated Supabase App Has (Lovable, Cursor, Bolt, v0)

#supabase #postgres #rls #security

3 min read

Cenk KURTOĞLU

Oct 17

Stop Losing 3 Hours a Day to Copy-Paste Work

#n8n #automation #openai #productivity

8 min read

Cenk KURTOĞLU

Oct 16

Prisma Migrations Hanging on Supabase Connection Poolers: Root Cause & Fix

#prisma #postgres #database #webdev

8 min read

Cenk KURTOĞLU

Oct 16

Test RLS Policies Safely with Neon Branching

#postgres #database #testing #devops

7 min read

Cenk KURTOĞLU

Oct 16

Supabase RLS Security: Why AI-Generated Code Is Leaking Your Data (And How to Fix It)

#supabase #postgres #security #database

7 min read

Cenk KURTOĞLU

Oct 14

Supabase Error 42501 "permission denied for table" — The October 30 Fix (Copy-Paste SQL)

#supabase #postgres #security #database

3 min read

Cenk KURTOĞLU

Oct 9

You Gave Your SECURITY DEFINER Function a Dedicated Owner Role. It Broke. Here's Why.

#supabase #postgres #security #backend

4 min read

Cenk KURTOĞLU

Oct 9

Supabase's Default Privileges Expose Every New Table. Here's the Self-Healing Fix.

#supabase #postgres #security #opensource

5 min read

Cenk KURTOĞLU

Oct 9

Supabase "permission denied" After October 30: The Exact Fix (Copy-Paste SQL)

#supabase #postgres #security #database

4 min read

Cenk KURTOĞLU

Oct 9

I Scanned 100 Public Supabase Repos. Here's What I Found.

#supabase #security #postgres #webdev

3 min read

Cenk KURTOĞLU

Oct 9

The Supabase Pre-Launch Security Checklist (Copy This Before Every Deploy)

#supabase #security #postgres #webdev

3 min read

Cenk KURTOĞLU

Oct 9

Your Supabase App Breaks on October 30. Here's the 30-Minute Preparation Guide.

#supabase #security #postgres #webdev

4 min read

Cenk KURTOĞLU

Oct 7

AI Built Your Supabase App and It Works. Here's What Breaks Next.

#supabase #ai #security #webdev

5 min read

Cenk KURTOĞLU

Oct 7

Supabase RLS Not Working? Fix It by Symptom (5 Symptoms, 30-Second Check for Each)

#supabase #postgres #security #webdev

5 min read

Cenk KURTOĞLU

Oct 5

3 Supabase RLS Leaks I Found in Production Apps This Week (and the 30-Second Check for Each)

#supabase #security #postgres #webdev

5 min read

Kaggle Benchmarking Challenge Submission

Cenk KURTOĞLU

Sep 30

I Found 60+ Live Supabase Keys in Public Repos, So I Benchmark Whether LLMs Can Spot Them

#devchallenge #kagglechallenge #ai #machinelearning

5 min read

Cenk KURTOĞLU

Sep 24

58 of 154 public Supabase apps had a working service_role key in git

#supabase #postgres #security #webdev

3 min read

Cenk KURTOĞLU

Sep 18

Supabase RLS: a small, evidence-first pre-launch check

#supabase #postgres #security #webdev

2 min read

Cenk KURTOĞLU

Sep 8

October 30, 2026: the Supabase change that will 42501 your next deploy - and the leak that was already there

#supabase #postgres #security #webdev

4 min read

Cenk KURTOĞLU

Sep 2

Supabase RLS returns rows it shouldn't (or throws 42501): the 6 real causes

#supabase #postgres #security #webdev

2 min read

Cenk KURTOĞLU

Aug 15

The service_role Key Hiding in Your .mcp.json — the AI-Vibe-Coder Secret Leak

#supabase #security #postgres #webdev

5 min read

Cenk KURTOĞLU

Aug 15

The Supabase Security Checklist to Run Before You Launch

#supabase #postgres #security #webdev

6 min read

Cenk KURTOĞLU

Aug 15

NEXT_PUBLIC_ and Supabase: Which Env Variables Are Safe to Expose?

#supabase #nextjs #security #webdev

5 min read

Cenk KURTOĞLU

Aug 15

You Committed .env to GitHub: What to Rotate (Supabase + Next.js)

#supabase #nextjs #security #postgres

6 min read

Cenk KURTOĞLU

Aug 15

Test Your Supabase RLS Policies Locally: A Free SQL Harness

#supabase #postgres #security #webdev

5 min read

Cenk KURTOĞLU

Aug 15

Supabase RLS with auth.uid() not working? Causes and fixes

#supabase #postgres #security #webdev

6 min read

Cenk KURTOĞLU

Aug 15

Is my Supabase anon key exposed? What's actually safe (and what isn't)

#supabase #postgres #security #webdev

5 min read

Cenk KURTOĞLU

Aug 14

Your AI Coding Tool Is Committing Your Supabase service_role Key

#supabase #security #postgres #webdev

6 min read

Cenk KURTOĞLU

Aug 14

Supabase RLS Not Working? Fix It by Symptom (Correct SQL Inside)

#supabase #postgres #security #webdev

5 min read

Cenk KURTOĞLU

Aug 13

You shipped a Supabase app with AI. Here are the 4 security holes it probably has (and the 5-minute fixes)

#supabase #postgres #security #webdev

5 min read

Cenk KURTOĞLU

Aug 13

New Row Violates Row-Level Security Policy: The Real Fix

#supabase #postgres #security #webdev

4 min read

Cenk KURTOĞLU

Aug 12

Supabase Storage Upload Fails With RLS (403: new row violates row-level security policy)

2 min read

Cenk KURTOĞLU

Aug 12

Why Supabase RLS Returns Nothing or 42501 (auth.uid() Is Null on the Server)

3 min read

Cenk KURTOĞLU

Aug 12

7 Ways Your Supabase App Still Leaks Data With RLS Enabled

3 min read

Cenk KURTOĞLU

Aug 12

Test your Supabase RLS before you ship: a free red/green fixture and the 9 SQL checks a linter cannot run

#supabase #postgres #security #webdev

4 min read

Cenk KURTOĞLU

Aug 7

Your Supabase service_role key is probably in your browser bundle

#supabase #nextjs #security #webdev

5 min read

Cenk KURTOĞLU

Aug 7

Stripe doesn't support my country. Here's how you ship a paid product anyway (2026)

#payments #saas #stripe #webdev

2 min read

Cenk KURTOĞLU

Aug 7

Two SQL queries that tell you whether your Supabase RLS is actually on

#postgres #security #supabase #webdev

6 min read

Cenk KURTOĞLU

Aug 7

Your Supabase service_role key is probably in your browser bundle

#supabase #security #nextjs #webdev

5 min read

2 Week Community Wellness Streak

1 Week Community Wellness Streak

Writing Debut

Want to connect with Cenk KURTOĞLU?