Blog

A Row Level Security Policy Is A Boundary You Have To Test From The Client Side

A platform-generated application stored every tenant table behind row level security. The policy was correct on paper and bypassable in practice, because the client held a key the policy trusted too much.