Your database
Security & compliance
Row-Level Security off / no policies (Postgres)
Part of the Database security posture check · fix arrives as a guide
What it is
A Postgres table has Row-Level Security disabled, or enabled with no policies defined.
Why it matters
Access control then exists only in application code, so any query path that forgets its tenant filter returns everything. It also means a compromised or misused connection has no database-level limit on what it reads.
How to fix it
Enable RLS on tables holding tenant data and add policies scoping rows to the owner. Where the application connects as a single role, use a session variable for the tenant and reference it in the policy.
Run them all on your app
Connect your repo and your live services with read-only scopes. The first scan is free, and nothing changes without your approval.