Scan a Supabase project for security issues: RLS gaps, exposed SECURITY DEFINER functions, public buckets, default-privilege leaks, and unsafe auth config. Returns findings JSON. Caches result for use by apply_fix tools.

List findings from the last audit of a project, optionally filtered by severity. Use after audit_project to inspect specific issues.

Preview what a fix would change WITHOUT applying it. Wraps the fix SQL in BEGIN; ... ROLLBACK; and returns what would have happened. Safe to call for any finding.

ACTUALLY APPLY a fix SQL to the project. Requires confirm=true. Always run preview_fix first. Re-runs audit afterward to verify the finding is gone.

Bulk-apply all SQL fixes from last audit, optionally filtered by severity. Wraps everything in a single transaction — if any statement fails, everything rolls back. Always preview the count and list before confirming.