RLS policy allows everyone

This rule catches the more insidious case: RLS is enabled, but the policy effectively says “allow everyone everything” (using (true)). Every dashboard then shows a green check — yet nothing is protected.

Such policies almost always originate during debugging. Something does not work, the rule is opened wide for a test, and afterwards it is forgotten. Nothing visible changes for the app, so it never surfaces.

Fix: bind every policy to identity — typically auth.uid() = user_id — instead of true. Check each operation separately: often SELECT is properly scoped while UPDATE or DELETE are still wide open.