Why AI-Generated Supabase Apps Leak User Data, and How to Audit Row-Level Security Before Launch