Notes from the build,
not from the pitch deck.

Row level security decides which rows each user can see, and in Supabase it is the only thing standing between a logged-in user and your whole table, because the database is exposed directly to the browser. Enable it on every table holding user data, then write a separate policy for SELECT, INSERT, UPDATE and DELETE. The four mistakes that cause real leaks are a policy of USING (true), covering SELECT but not the write commands, putting a role column in a user-writable table, and never testing as a second user.