Every week I audit a handful of AI-generated apps (VibeScan is the service behind this). The single most common "how is this in production" finding is a broken Row Level Security policy. Usually it's one of: RLS is disabled and the table is just public RLS is enabled but every policy is USING (true) — so it's still public, it just looks secure The policy scopes reads correctly, but the UPDATE pol