All 25 of our tables have row level security on and not one policy, and that is the finished design

A Supabase project has two doors into the same database. We use one of them, so every table is switched to deny-by-default and stays that way. What that actually does, shown in a throwaway Postgres, plus the three gaps the census found.