From community review to a shipped security hardening with Codex

A small open-source TypeScript toolkit called Tenant Evidence Kit was developed to handle private, multi-tenant evidence workflows on Supabase. The project's origin was a specific need to attach photos, documents, or other evidence to business objects without compromising security. The toolkit maintains a small infrastructure and is domain-agnostic, providing features such as private Supabase Storage, evidence metadata separation from file bytes, tenant isolation with Row Level Security, short-lived signed URLs, and cleanup processes in case metadata persistence fails.

When releasing the toolkit, a community review found several issues related to authorization, deletion, and the lack of UPDATE support. To address these concerns, the project underwent a review loop in which Codex, an AI agent, was used to implement the identified improvements. The workflow involved receiving a community review, turning the feedback into a scoped issue, having Codex implement the solution, undergoing a human review, making corrections, passing through CI, and finally releasing the updated version.

The first implementation introduced operation-specific evidence permissions, restricted evidence deletion to owners and admins, preserved existing read/create behavior for active members, made evidence metadata explicitly append-only, and added a separate migration for existing installations. Additionally, real Supabase/pgTAP authorization tests, CI coverage for database authorization, and explicit documentation of the RLS execution boundary were included. Storage and Postgres now share the same permission model for evidence operations.

The goal was not to create a large authorization framework but to make the existing security boundary more explicit, testable, and upgrade-safe. The author learned that giving the agent a reviewable engineering boundary made the task easier to evaluate. Despite the agent's contribution, the human review step remained crucial.