3  What we found

Documenting a surface is a way of measuring it. These are the figures the exercise produced. None of them is a new defect discovered by inspection; each is a property of the surface that could not be stated as a quantity until every operation had been counted.

3.1 The database is not always the boundary

25 of 196 operations build a Supabase client with the service-role key. That client is not subject to row-level security. For these operations, the thing keeping one customer’s rows away from another is the handler’s own code — not the database.

That is a legitimate pattern and sometimes the only one available. What the count changes is its status: 25 handlers now constitute a named review surface rather than an implementation detail spread across the tree.

1 of those 25 contain no call that resolves a user. This is a review list, not a defect list. An operation whose entire job is signing someone in cannot verify a caller who is not yet signed in, and at least one entry is exactly that. What the list establishes is that for each of them, the reasoning has to be in the handler, because it is not in the database. The security appendix names them.

3.2 99 operations change state

Just over a third of the surface writes. Every one of them names the tables it writes and the verbs it uses, in its own entry — which means the blast radius of any single operation is now a lookup rather than an investigation.

3.3 What the specification does not say

6 operations declare no authentication scheme. An absent declaration is not the same as a public endpoint: it means the specification is silent, and a reader cannot tell which. Silence renders ambiguously in Swagger UI and reads as “no auth required” to anyone integrating.

51 operations return a shape that could not be read from the source. The handler assembles its response at run time rather than returning a literal, so this document reports the gap instead of inventing a field list. That is the honest outcome, and it is also a small backlog: each one is a handler whose return shape nobody can see without executing it.

3.4 What this exercise did not do

It did not test anything. Every statement here is read from the specification or from handler source. An operation can be perfectly described and still be wrong at run time, and nothing in this document would show it.