The test question 'if a stranger calls every table directly with the anon key, what do they get?' is the clearest way to frame this, because it moves the focus from hiding the key to what RLS actually allows. Noting that the newer sb_publishable_ and sb_secret_ formats exist alongside the legacy JWT keys is helpful too. The warning not to paste a possible service_role key into a third-party decoder is easy to miss and worth the space.