A working checklist for Supabase security: RLS policies, anon keys, service role leaks, and the mistakes I keep finding in AI-built apps.