How do you handle Supabase Row-Level Security?

RLS on for every public table. No USING (true) policies. Every multi-tenant table has a policy keyed off auth.uid() or a tenant column. Service role key is server-side only — never NEXTPUBLIC. Storage buckets default to private with explicit policies for public assets. We run a SQL audit on intake of any rescue project and write the missing policies in the foundation week.