Supabase scans customer setups and throws up loud warnings for insecure setups aka RLS is disabled on $table, and unless the PM is totally irresponsible, they can throw that email at their LLM of choice and ask it "is this a problem, will I get hacked?" and the LLM will do a fairly competent review of the issue. So it's scary from a security perspective in so far as you do or don't trust AI to find issues.