Security Advisor lints to clear before launch, performance ones after

The answer. The dashboard runs a set of named lints against your schema (Database → Advisors) and the names are stable, which makes them a checklist you can grep for in a migration review. The security set is the one to empty before anything public: a table in an exposed schema without RLS, a view that exposes auth.users, a view or function running as its definer and reachable by anon, sensitive columns on an unprotected table, policies that trust user_metadata, and queue or foreign tables in the API. The performance set is cheaper to ignore for a week but not longer: policies calling auth.uid() per row, foreign keys without indexes, duplicate or unused indexes, and table bloat. Each lint links to a remediation page; most fixes are one statement.

The pattern.

Lint	Meaning	Fix
`0013_rls_disabled_in_public`	table reachable without RLS	`enable row level security` + policy
`0002_auth_users_exposed`	a view leaks users' PII	drop the view or move it out of the API
`0010_security_definer_view`	view bypasses RLS	`with (security_invoker = on)`
`0028/0029_*_security_definer_function_executable`	definer RPC callable by anon / authenticated	guard inside or `revoke execute`
`0015_rls_references_user_metadata`	policy trusts user-editable data	read `app_metadata` instead
`0024_permissive_rls_policy`	`using (true)`	write the real predicate
`0011_function_search_path_mutable`	no pinned search_path	`set search_path = ''`
`0003_auth_rls_initplan`	`auth.uid()` per row	`(select auth.uid())`
`0001_unindexed_foreign_keys`	joins scan	add the index
`0025_public_bucket_allows_listing`	bucket enumerable	drop the SELECT policy

Watch out.

The advisor reads the live schema, so a fix in a migration counts only once it is applied; re-run after db push.
0012_auth_allow_anonymous_sign_ins fires only when the feature is on and is a review prompt, not a defect.
Lints do not know your intent. A public read-only reference table with using (true) is fine; mark the exception in a comment, not by disabling RLS.