Open to contract work. Working remotely with clients in the US and EU.
- LeaseAI — AI lease-analysis SaaS I built and run: Supabase backend with hardened row-level security and rate limiting, Paddle billing, live payments.
- AI partner-outreach system for a US moving company (client project, private) — finds partners in target cities daily, enriches contacts, sends personalized emails with follow-ups, classifies replies with an LLM and hands interested leads to the sales team. Self-hosted n8n + Postgres, separate sending domain with warm-up, error watchdog and daily backups.
- supabase-security-mcp — MCP server that audits a Supabase project from Claude/Cursor: anon-key probe, RLS policy audit (using(true), missing TO clause, exposed SECURITY DEFINER), two-account cross-tenant test.
npx supabase-security-mcp. - RLS Watch — self-hosted daily security monitor for agencies running many Supabase projects: same checks, diff vs yesterday, Telegram alerts, client report. Live at watch.sixthgear.dev.
- supabase-grants — checks Supabase table grants against RLS policies. Generates least-privilege migrations, scans migrations for the Oct 30 2026 change, and includes a study of 580 public Lovable repos.
- n8n-sunset (npm, v0.2.0) — scans n8n workflow exports for nodes removed or changed in n8n 3.0 and for OpenAI, Anthropic and Gemini model shutdowns. Runs offline and in CI.
npx n8n-sunset@latest. - LeadBox security demo — live before/after showing how an AI-built app leaks every user's data when row-level security isn't done right, and what "fixed" looks like. Try both buttons.
Not merged yet.
- supabase/splinter#197 — new Security Advisor lint
0031_policy_without_privilege. - github/github-mcp-server#3293 — add explicit
destructiveHint: falseto non-destructive write tools. - github/github-mcp-server#3317 —
pull_request_read: reject pagination parameters the selected method does not support. Related issue: #3316.
- Full-stack web apps (React / Next.js / Supabase).
- AI agents and LLM integrations.
- n8n automations and Telegram bots.
- Taking AI-built apps (Lovable, Bolt, v0, Cursor) to production, including Supabase security.