security-sensitive-change-review

To review Supabase RLS policy changes for data exposure, audit whether all required actions (SELECT, INSERT, UPDATE, DELETE) maintain correct coverage and do not broaden access unintentionally. Verify that protected data areas remain secured before deploying.

Preventing environment variable exposure in Next.js server routes requires verifying that secrets are accessed via getServerEnv() rather than process.env in unsafe contexts. Systematic checks ensure server-only variables remain protected during code changes.

A Clerk middleware routing change alters authentication boundaries by modifying access controls. Security review confirms these changes do not broaden access unintentionally and that protected routes remain properly gated before changes reach production.

Assessing migration safety for destructive database operations requires evaluating deployment risk, verifying audit logging preservation, and checking whether protected data areas are impacted. Systematic review prevents unsafe migrations from reaching production.

Yes, this security review applies to Next.js server routes, deployment steps, and infrastructure changes. It audits authentication, authorization, secrets, and data access modifications across these contexts to prevent insecure changes from shipping.

Auditing authentication and secret changes requires systematic checks across environment variables, migration safety, and policy coverage for all CRUD actions. Limitations arise when changes bypass reviewed contexts or involve unprotected data areas outside the audit scope.