This Android app is a public client. Only Supabase publishable keys belong in the app configuration. Never commit or ship Supabase service_role keys, database passwords, signing keystores, Google client secrets, personal account credentials, or .env files.

Local app configuration belongs in local.properties, which is gitignored. Use local.properties.example as the template for required keys.

Before using any Supabase project with this app, enable Row-Level Security on every user-owned table. The publishable key is only acceptable when RLS and RPC ownership checks prevent cross-user access.