Synthetic portfolio sample

Supabase RLS Review

A compact example of the evidence, severity ranking and remediation format used in a human RLS review.

Important: Every table, tenant, user and finding below is fictional. This page contains no client data and is not presented as a completed customer engagement.

Executive summary

The synthetic review found one critical, one high and one medium issue. The most serious policy checks only whether a user is authenticated; it does not verify tenant membership, allowing cross-tenant reads.

1Critical

1High

1Medium

Test model

User A belongs to Tenant Alpha.
User B belongs to Tenant Beta.
Expected: User A cannot read, create, update or delete Tenant Beta rows.

Critical · RLS-001

SELECT policy missing tenant membership

Evidence: the policy permits every authenticated user.

create policy "authenticated users can read projects"
on public.projects for select to authenticated
using (true);

Observed: User A received one Tenant Beta row. Expected: zero rows.

Fix direction: require an existing membership row matching both projects.tenant_id and auth.uid(), then repeat the two-user negative test.

High · RLS-002

UPDATE policy has no reliable WITH CHECK boundary

The existing USING condition controls which row may be selected for update, but the new row state is not constrained. A user may attempt to move a row to another tenant.

Fix direction: apply the membership condition to both USING and WITH CHECK; verify that changing an Alpha row to tenant-beta is rejected.

Medium · STO-001

Storage path is broader than the ownership model

The synthetic upload policy trusts an object path without checking the tenant/user ownership record.

Fix direction: bind the path to an authorized tenant and test download, overwrite and delete behavior with two identities.

What a real review includes

policy coverage for SELECT, INSERT, UPDATE and DELETE,
anon/authenticated and cross-user boundary notes,
reproducible checks, severity and practical remediation order.

A real result can also be “no issue reproduced.” The service guarantees the scoped review and evidence format, not that a vulnerability will be found or that the application is secure.

Review three sensitive tables

Five launch slots. Use LAUNCH20 for $15.20 total and a $7.60 deposit today. Never send production secrets or customer data.

Review the full scope