diff --git a/supabase/migrations/20260227161801_add_policy_allow_read_profile_from_requesters.sql b/supabase/migrations/20260227161801_add_policy_allow_read_profile_from_requesters.sql
new file mode 100644
index 00000000..245f21ef
--- /dev/null
+++ b/supabase/migrations/20260227161801_add_policy_allow_read_profile_from_requesters.sql
@@ -0,0 +1,31 @@
+-- ============================================================================
+-- RLS POLICY
+-- ============================================================================
+-- 
+-- Drop policy if it exists to ensure idempotency
+drop policy if exists "project members can read requesting user profile"
+  on public.profile;
+
+-- Allow authenticated users to read the profile of users who have sent
+-- requests to projects the current user is linked to
+-- Rationale: A profile should only be visible to authenticated users
+-- when there is a legitimate relationship established via a request
+-- tied to one of their projects. This prevents unrestricted profile
+-- access while enabling necessary visibility within project context.
+create policy "project members can read requesting user profile"
+  on public.profile
+  for select
+  to authenticated
+  using (
+    exists (
+      select 1
+      from public.request r
+      where r.sender_profile_id = profile.id
+        and exists (
+          select 1
+          from public.profile_project_link ppl
+          where ppl.project_id = r.project_id
+            and ppl.profile_id = auth.uid()
+        )
+    )
+  );
\ No newline at end of file