Supabase tightened the default today. New projects no longer auto-expose public-schema tables to PostgREST/GraphQL — explicit Postgres grants required. Also: @supabase/server (one SDK across runtimes), branching without Git as default, Stripe Marketplace GA. Five takeaways below.