docs: Supabase deployment readiness audit (2026-05-13)

[adm01-debug]

Summary

• Adds AUDITORIA_SUPABASE_DEPLOY_2026-05-13.md — exhaustive readiness audit of Supabase project doufsxqlfjyuvxuezpln against the GitHub repository
• Overall score: ~86/100 — project is substantially ready but has actionable blockers before a full production deploy

Key findings

• 100% RLS coverage on all 258 public-schema tables
• 76/76 Edge Functions ACTIVE — 9 have verify_jwt: false (documented and intentional)
• 2 SECURITY DEFINER functions still callable by authenticated role: is_admin_or_above and is_coord_or_above — remediation migration needed (apply via MCP only, never supabase db push)
• Storage gap: recibos-entrega bucket missing SELECT policy — users cannot read their own receipts (requires Supabase Dashboard UI fix)
• 572 unused indexes flagged by Supabase performance advisor — non-blocking but should be cleaned up post-deploy
• 3 critical security PRs open: security: audit remediation batch 2 — error redaction, auth gates, timing-safe comparisons, fail-closed access control #175 (SECURITY DEFINER T37e), fix(db): T35-T37d — segurança completa: RLS, default privileges e 322 violações SECURITY DEFINER eliminadas #169 (seller-scope hardening), security(db): Hardening completo T19→T33 — 0 lints no Security Advisor (10/10) #160 (storage policies)
• Migration desync: local repo has 392 migration files, cloud applied 246+; CI guard blocks supabase db push — always apply via MCP apply_migration

Test plan

• Review the audit document for completeness and accuracy
• Apply SECURITY DEFINER fix migration via MCP apply_migration (not supabase db push)
• Add SELECT policy to recibos-entrega bucket via Supabase Dashboard
• Merge or close critical security PRs security: audit remediation batch 2 — error redaction, auth gates, timing-safe comparisons, fail-closed access control #175, fix(db): T35-T37d — segurança completa: RLS, default privileges e 322 violações SECURITY DEFINER eliminadas #169, security(db): Hardening completo T19→T33 — 0 lints no Security Advisor (10/10) #160
• Re-run audit after remediations to confirm score improves to ≥95/100

https://claude.ai/code/session_01Mg1JjkG8pcqyXxbEqPDGvd

---

Generated by Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
promo-gifts	Error		May 13, 2026 11:22pm

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 7803bd3f-472c-49cd-b0a5-837c22f06037

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch claude/validate-supabase-deployment-wQ9br

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[supabase]

This pull request has been ignored for the connected project doufsxqlfjyuvxuezpln because there are no changes detected in supabase directory. You can change this behaviour in Project Integrations Settings ↗︎.

---

Preview Branches by Supabase.
Learn more about Supabase Branching ↗︎.

[cubic-dev-ai]

No issues found across 2 files