It's a shame that making things easy to use has typically meant the user gives up control/hosting capabilities and generally gets less security out of the box. You're probably right about Supabase, that they made that tradeoff explicitly, but they have more demand than they keep up with and finally seem to be course correcting toward more secure defaults that apparently will make onboarding their users more difficult (this is a false dilemma IMO). There isn't a real attempt at transparency with the app builders e.g lovable, bolt, v0, replit, base44 because that's not really the point. The vibecoding tools all sell the idea of a concierge service but that only works if the experience is actually "luxury" which in this case means you can trust in a guaranteed basic level of data privacy. People who don't get Postgres and RLS implement it sloppily and you inevitably get cases like this. You can put that on the user but I think platforms have a higher bar here to create experiences or interfaces where the easy path is the most secure one. There are obviously many other parts of these process that can be leaky beyond the database as well so the app architecture needs to make the system cohere together securely and I just don't feel like the existing options are fully up to the task.