Reviews Postgres and Supabase row-level security before you merge: who can read or change which rows - an anonymous visitor with the publishable key, any signed-up user, another tenant - and who can reach further than the policies say. Catches tables with RLS off, policies that are always true or apply to every role, missing WITH CHECK, owner and tenant columns left unchecked, privilege columns users can edit, claims from user_metadata, views and SECURITY DEFINER functions that run as their owner, and service keys in the client, then gives the smallest SQL that closes each path and what to check if it is already live.