Over-permissive RLS policy on a table — no tenant scoping
Part of the RLS & tenant isolation check · fix arrives as a pull request
What it is
A policy exists but does not scope rows to the caller — USING (true), a grant to anon or public with no predicate, or a check that only confirms the caller is authenticated.
Why it matters
This is the case advisors stay silent on, because RLS is enabled. Any logged-in user reads every tenant's rows, and the settings page shows the table as protected.
How to fix it
Rewrite the predicate to compare against the caller — (select auth.uid()) = user_id, or a tenant lookup. Authentication is not authorization: auth.role() = 'authenticated' grants everything to everyone with an account.
Run them all on your app
Connect your repo and your live services with read-only scopes. The first scan is free, and nothing changes without your approval.