Marked as helpful by the asker
Checked the repo. Good: RLS on bookings, keys server-side. Fix before launch: the SMS webhook has no signature check (anyone can trigger reminders), and bookings.customer_phone is readable by every signed-in user because the policy is auth.uid() is not null. Restrict to the salon owner and the customer.