Audit the access rules on my client-facing database (Supabase row-level security, Firebase Realtime Database / Firestore rules, or any database my frontend talks to directly with a public key). For Supabase: verify RLS is enabled on every table (not just the ones with policies), and that policies enforce per-user ownership for reads and writes, since enabling RLS with no policies blocks everything but a single permissive policy (USING true) is the same as no RLS. For Firebase: read the actual rules file and test the cases it claims to handle. In both cases, enumerate every table or collection and classify it: public read, per-user, admin-only, or server-only. Server-only data must not be reachable with the public anon key at all. Pay attention to write rules, not just reads; public write access is how databases fill with garbage and how users overwrite each other's rows. Do not tighten rules blindly and break the app; test each legitimate client operation against the new rules as you go. Do not move data models around. Deliver a table-by-table access report with the fixes applied, plus a verification per table using the anon key: an unauthenticated request and a wrong-user request, both refused where they should be.