No RLS policy found for a queried table — lockout or bypass risk

What it is

A table the application queries has RLS enabled but no CREATE POLICY statement anywhere in the migrations.

Why it matters

It fails in one of two directions and both are quiet. Either every query returns zero rows with no error, or the code works only because it uses a SECURITY DEFINER path or the service-role key that bypasses RLS entirely.

How to fix it

Add explicit policies for each operation the application performs, scoped to the owner or tenant column. If the code currently works through a service-role client, treat that as the finding — the policy is what should be enforcing this.