The Launch-Day Security Checklist Lovable's Scan Does Not Run

A code scan and a project configuration are two different objects. Lovable's scans read the first. Most of Supabase's own production checklist lives in the second, and it is off until somebody turns it on.