Six security holes I check for before a Supabase + Stripe app goes live

Apps built fast with Lovable, Bolt, Cursor or Claude Code tend to break in the same few places. The demo looks great, and then one of these six things is sitting in the repo. I wrote a small free chec