Your database Security & compliance

Row-Level Security off / no policies (Postgres)

Part of the Database security posture check · fix arrives as a guide

What it is

A Postgres table has Row-Level Security disabled, or enabled with no policies defined.

Why it matters

Access control then exists only in application code, so any query path that forgets its tenant filter returns everything. It also means a compromised or misused connection has no database-level limit on what it reads.

How to fix it

Enable RLS on tables holding tenant data and add policies scoping rows to the owner. Where the application connects as a single role, use a session variable for the tenant and reference it in the policy.

Run them all on your app

Connect your repo and your live services with read-only scopes. The first scan is free, and nothing changes without your approval.