Row-level security never switched on.
New tables shipped without row-level security, readable by anyone holding the public client key.
- Discovered (complete)
- Proven (complete)
- Fixed (not yet published)
- Retested (not yet published)
What they were shipping
A credit-based developer SaaS querying a hosted database directly from the browser.
What we found
The app queried a hosted database from the browser with a public key. New tables for credits, integration tokens and workspace members shipped without a row-level security policy enabled.
How we proved it
Using only the public key shipped in the frontend, a browser console could select whole tables across every paying customer.
Business impact
Third-party integration tokens and billing balances for every customer were readable.
Fix
Enable row-level security on every table, deny by default, and add a check to the migration pipeline that fails when a table has none.
Retest
Retest status not published for this case.
Why it keeps happening
Client-side database access is the default in modern stacks, and a new table is open by default until you say otherwise. One forgotten migration is a full multi-tenant leak.