Four things every Supabase app needs before real users hit it, and that are easy to get wrong: rate limiting, per-user resource limits, private storage, and an immutable audit log. Drop-in SQL migrations plus client helpers, taken from a production app.A tampered client can't spam your tables (Postgres rate limiting, no Redis), can't exceed a free-tier cap (a DB trigger, not just a client check), can't read another user's files (private bucket, signed URLs only), and can't rewrite its own audit trail (append-only, blocked even for the service role).Each migration is independent, use the ones you want. Single-project commercial use.The full write-up behind this kit: Rate limiting in Postgres, no Redis.