tomvibes git.example.com/tomachterberg/team-crm ↗
Team of eight, all trusted. Bolt made one big contacts table with no per-user restrictions. Is that fine for an internal tool?
For eight trusted people, one shared table is a reasonable choice, but 'no restrictions' should mean 'signed-in team members only', not 'anyone with the URL'. Add RLS with auth.uid() is not null and an allowlist of team emails in a team_members table. Ten minutes, and the difference between internal and public.
Before and after you add Lena's policies, test it the way an outsider would. The anon key is in your frontend bundle, so this is what anyone who opens devtools can do:
That's your contacts table, from a laptop that has never logged in. After RLS with auth.uid() is not null the same request should return []. Keep the command in your README and run it after every schema change. Two seconds, and it's the only test that tells you what the internet sees.
tomvibes mattias 