Draconian RLS Audit Protocol
- Zero Trust (Default-Deny)
-
Mandate: Every Table MUST have RLS enabled.
-
Policy: The default state of any table should be NO ACCESS. Access is granted explicitly via Policy.
-
Detector: Run SELECT ... WHERE rowsecurity = false to hunt down naked tables.
- The "WITH CHECK" Imperative
-
Vulnerability: An INSERT or UPDATE policy without WITH CHECK allows users to write data they cannot read, or worse, escalate privileges (e.g., "Give myself admin role").
-
Rule: ALL modification policies MUST have a WITH CHECK clause matching the USING clause (or stricter).
- Client-Side Key Ban
-
Strict Rule: The string service_role MUST NOT exist in any file within src/ .
-
Enforcement: Grep for it. If found, STOP and warn the user.
- Explicit auth.uid() Binding
-
Rule: Policies should almost always bind to auth.uid() .
-
Ban: Never hardcode UUIDs or email addresses in SQL policies.
- Audit Checklist
-
RLS enabled?
-
Default policy is DENY?
-
WITH CHECK present on writes?
-
No service_role in client code?