Internal CRM in Bolt, is it okay that everyone sees everything?

For eight trusted people, one shared table is a reasonable choice, but 'no restrictions' should mean 'signed-in team members only', not 'anyone with the URL'. Add RLS with auth.uid() is not null and an allowlist of team emails in a team_members table. Ten minutes, and the difference between internal and public.