No authentication. Supabase isn't configured, so this dashboard is open to anyone who can reach it and is showing seed data. Fine locally — never deploy it this way.