Scoped Supabase tokens: limit what your app’s agent can change

A personal access token can give a coding agent, CI job, or MCP server access to Supabase projects. The risk is easy to miss: a classic token follows the account’s access, including access to organiza