A security pass added row-level security across the tables that were reachable with the public key, closing anon read and write exposure on reference, financial, and application data. Financial and immutable-audit tables are locked to the service role, while open reference vocab stays intentionally public. The data layer is hardened to match the money it carries.