How do I find security & performance issues in my backend?

This applies to a managed backend. Advisors reads your schema (it never changes anything) and reports findings grouped by Security and Performance, ordered worst-first. It pairs with the RLS policy templates: templates help you apply safe access rules; Advisors tells you where you forgot to.

What it checks

Security

• RLS disabled (error) — a table has row-level security off, so every row is readable/writable by anyone with the anon key. Fix: enable RLS and add a policy (use the templates).
• Policies exist but RLS is off (error) — you wrote policies, but they do nothing because RLS isn't enabled. Fix: ALTER TABLE … ENABLE ROW LEVEL SECURITY;
• Mutable function search_path (warn) — a function without a pinned search_path can be hijacked. Fix: SET search_path = '' in the function.

Performance

• No primary key — row updates/deletes and realtime tracking work better with one.
• Duplicate index — identical indexes waste space and slow writes; drop all but one.
• Multiple permissive policies — several permissive policies for the same role+action all run on every query; combine them.
• Unindexed foreign key — joins and cascade deletes scan the whole table; add an index on the FK column(s).

Run it, fix it, re-run

1. Open lingcode.dev/backends → Database → Advisors. Read the findings worst-first.
2. Fix the errors first — usually "enable RLS + add a policy." You can apply a policy from the templates, or ask the agent ("turn on RLS for notes so each user only sees their own rows").
3. Click Advisors again — a resolved issue drops off the list. The goal is no errors; warnings and info are judgment calls.

What's next