Plan-only OWASP Top 10 and Supabase-first hardening burndown. Use when "security audit plan", "OWASP audit", "hardening plan", or "security burndown". Auth flows → audit-auth-flows. RLS → plan-rls-audit. Keys → plan-secrets-audit.
