Row Level Security (RLS)

With RLS switched on, every query against a table is filtered by policies such as 'a user can read orders whose user_id is their own id'. Because the rule lives in the database, it holds on every path in: the app, an admin script or an automatic API.

It matters most on platforms such as Supabase, where apps query tables directly with a public key. A table with RLS switched off, or with a policy that simply says true, is open to anyone who has that key, so every table's policies deserve a review.