Browser writes directly to the database

This is the single most common pattern in AI-built apps: the component calls `supabase.from("table").insert(...)` and the browser talks to the database directly. In our own vibe-code audit that was the case in 5 of 12 generated features.

It is not a flaw by itself — Supabase is built for it. But it moves all access control into the database: from here on only Row Level Security decides WHO may write, and nobody checks WHAT gets written. No schema check, no rate limit, no spam protection — a contact form without a server is also an open write channel.

Check: for every table named, is there a policy binding that specific operation to `auth.uid()`? If a delete runs from the browser, doubly so. Anything that needs validation or limits (forms, payments, invitations) belongs behind its own endpoint.