What I check: row level security on every table, what your public key exposes while signed out, storage buckets and signed links, edge function auth, rate limits and secrets, database functions anyone can call, and every Supabase security advisor finding in plain English.