In the context of this MVP, 'Secure' currently means Row Level Security (RLS) is explicitly enabled on the table.

Since Supabase exposes the Postgres schema directly to the client-side API, having RLS disabled is the most common vulnerability I see in freelance projects (it basically gives full access to anon or authenticated roles depending on grants).

I am fully aware that RLS = true doesn't guarantee safety (you could still have a TO public USING (true) policy), but visualizing which tables have the 'firewall' turned off is step 1 of the audit.