chore(studio): default opt-in security notifications

[dnywh]

What kind of change does this PR introduce?

• Feature flag tweaks
• Resolves DEPR-134

What is the current behavior?

• The securityNotifications flag’s related feature preview is opt-in
  • Meaning all users must explicitly opt-in to see the feature

What is the new behavior?

• The securityNotifications flag’s related feature preview is opt-out
  • Meaning all users have this feature preview enabled, and must explicitly opt-out to go back to the previous UI

Note

We need to set the corresponding ConfigCat flag to 20% (or similar) to avoid rolling this out to everyone all at once.

Additional context

I decided not to update the notice Admonition (with a link back to this feature preview in case folks want to later opt-out) because:

• I don’t think it’s a controversial enough change
• The Admonition is already quite lengthy

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Preview	Comments	Updated (UTC)
studio-self-hosted	Ready	Preview	Comment	Nov 13, 2025 10:01am
studio-staging	Ready	Preview	Comment	Nov 13, 2025 10:01am

6 Skipped Deployments

Project	Deployment	Preview	Comments	Updated (UTC)
studio	Ignored			Nov 13, 2025 10:01am
cms	Skipped			Nov 13, 2025 10:01am
design-system	Skipped			Nov 13, 2025 10:01am
docs	Skipped			Nov 13, 2025 10:01am
ui-library	Skipped			Nov 13, 2025 10:01am
zone-www-dot-com	Skipped			Nov 13, 2025 10:01am

[supabase]

This pull request has been ignored for the connected project xguihxuzqibwxjnimxev because there are no changes detected in supabase directory. You can change this behaviour in Project Integrations Settings ↗︎.

---

Preview Branches by Supabase.
Learn more about Supabase Branching ↗︎.

[coveralls]

coverage: 68.718%. remained the same
when pulling 243e892 on dnywh/chore/security-notifs-incremental-rollout
into 482aeb7 on master.

[github-actions]

Studio E2E Results

• Total: 1
• Passed: 1
• Failed: 0
• Skipped: 0
• Timed out: 0
• Interrupted: 0
• Flaky: 0
• Duration: 3.0s

Artifacts: https://github.com/supabase/supabase/actions/runs/19327516266

Last updated: Thursday 13, November, 2025 10:12:45 (UTC)

[joshenlim]

Verified changes on staging! minimally that feature preview is still available

[joshenlim]

JFYI the E2E tests were failing on this branch (specifically database.spec) somehow despite multiple re-runs, but i've checked locally
all seems alright