View bypasses Row Level Security

By default, Postgres views run with their owner's privileges, in Supabase usually `postgres`. The RLS policies of the underlying tables then do not apply: whoever may read the view sees every row it shows — including other users' rows.

It rarely stands out, because the tables themselves are properly protected and every policy review comes back green. The view is a second, unprotected entrance to the same data. The Supabase Security Advisor reports it as “Security Definer View”; materialized views have no RLS at all.

Fix: create views with `security_invoker = true` so the table policies apply to the caller. Materialized views belong in a schema the API does not serve.