We wrote 32 row level security policies and not one of them runs when our app queries the database
If you use Supabase as a database rather than a backend, your own queries bypass RLS entirely. The policies are still not optional, because the door they guard is open whether you use it or not.
🎯 Vulnerability: Web Security Vulnerability
💡 Defense Fix: Implement strict input validation, contextual output encoding, and enforce least-privilege authorization controls.