A while back I wrote up the pass I run over code an assistant wrote for me: secrets in git history, keys leaking into the client bundle, API routes with no guard, stale dependencies, wildcard CORS. Every one of those lives in your application code.
There is a layer underneath that, and it fails differently. If you are on Supabase, or any Postgres with Row Level Security, your database is reachable from the browser by design. The anon key is meant to be public. The thing standing between a stranger and your profiles table is not your login screen and not your API route. It is your RLS policies.
The failure I keep running into is not "I forgot about RLS." It is "RLS is on, the dashboard shows a green shield, and the table is still readable by anyone." Those are not the same state, and the dashboard does not really distinguish them for you.
One caveat before the commands: run these against a project you own. Pointing them at someone else's project is unauthorized access, and in most places that is a crime, not a code review.
The one test that matters
