Name Supabase and OpenAI, not 'our providers'

Visitors can see the script

A Supabase project calls a supabase.co host. An OpenAI feature in the client calls api.openai.com. Anyone can open the network panel and see those names. A policy that says 'we use trusted third parties' is already behind the page.

Server-side keys do not appear in the scan. Treat the detected list as the floor. If you add PostHog next week, the policy is stale that day. That is what the $9 monthly re-scan is for: an email when a new vendor shows up, and a confirm step before the hosted page changes.