Protected columns?

create table public.profiles (
  id uuid references auth.users not null,
  username text unique not null,
  email text unique not null,
  created_at timestamp with time zone,
  updated_at timestamp with time zone,
  avatar_url text,

  primary key (id),
  unique(username),
  constraint username_length check (char_length(username) >= 3)
);

-- ...
create policy "Users can update their own profile." on public.profiles
  for update using (auth.uid() = id);
-- ...