School · Auth and database rules

Auth and database rules

Supabase RLS, Firebase rules, and server-side ownership checks so one user cannot read another.

1. Turn on Supabase RLS on every table
2. Keep the service_role key on the server
3. Check ownership on the server (stop IDOR)
4. Keep storage buckets private by default

All school modules