Public Database Check

Why the app working proves nothing

The anon key is meant to be public. An assistant asked for "a table for user notes" writes the table; the app works immediately because that key can read it. It keeps working, for everyone, including whoever opens devtools, copies the key off your own page and queries the table directly. Nothing errors. The app is not broken — it is just also not private.

The mirror-image failure

Turn row-level security ON and write no policies and Postgres denies everything. The table is perfectly safe and completely unusable: every query returns zero rows, silently, with no error. People debug that for hours, and the fix that "works" is the one that turns RLS back off.

So both are reported, DIFFERENTLY. A table nobody can read is not a security finding — it is a broken feature, and calling it a vulnerability points at exactly the wrong remedy.

| verdict | meaning | |---|---| | `world_writable` | anyone with the public key can write — the worst available | | `rls_disabled` | table created, RLS never enabled | | `world_readable` | a policy reads using (true) | | `locked_out` | RLS on, no policies: safe and broken, not a leak | | `protected` | RLS on with a conditional policy |

The details that decide whether it is right

Migrations are folded together before judging — a table is created in one file and secured in the next by convention, and judging file-by-file would report a false finding on essentially every correctly-secured project.

A later DISABLE beats an earlier ENABLE. Not a corner case: it is the exact sequence that produces the bug.

Every policy is kept, not just the last. Postgres ORs permissive policies together, so an open using (true) added early and never dropped leaves the table wide open even though the proper owner-scoped policy added later is perfect. Reporting the most recent policy would look at that table and see the good one.

An omitted FOR clause means ALL, so reading it as select-only would downgrade the most permissive shape somebody can write.

What it cannot see

Policies created by hand in a dashboard. It reads files — no connection, no credentials, no execution — so when it finds nothing it SAYS so rather than printing a clean bill of health it has no basis for. And it confirms a filter exists, not that the filter is correct.

Verified

17 tests, 10 deliberate defects, all 10 caught — including a re-disabled table reading as protected, using (true) no longer recognised as unconditional, the locked-out table reported as a leak, and an empty scan printing "no problems found".

Delivery

Source delivered as a private repository invite within 24 hours of purchase. Single-product commercial license: use and modify in any number of products; no redistribution or resale of the source.

Interface

What you call, and what comes back. Types and signatures only — the implementation ships with the source.

  export function scanDatabaseExposure(files: SourceFile[], options: ScanOptions = {}): TableFinding[];
  export function hasOpenData(findings: TableFinding[]): boolean;
  export function formatTableFindings(findings: TableFinding[]): string;