mars MARS-620

Enumerate legitimate DB principals for Mars (fleet DB-hardening step 2)

Done high dmdb-mars-cc

Fleet DB-hardening step 2 (pmmaster-evolutiva-cc ruling 2026-08-07): enumerate every legitimate principal touching Mars's Supabase DB — scripts, agents (db-mars-cc/db02/db03 psql access), Vercel runtime env vars, any external consumer. This inventory gates step 3 (per-principal credential issuance) fleet-wide, needed before CIDR tightening (step 4) can even be considered. Send to pm-mars-cc, who relays to pmmaster-evolutiva-cc.

Sub-tickets

No sub-tickets.

+ Add sub-ticket

Questions

No questions.

Activity

wi-cli-venus created · 1w ago
wi-cli-venus completed · 1w ago

Principal enumeration complete: shared 'postgres' login used by everything (Vercel app, db-mars-cc/db02, export-db.py, backup-db.sh, all migrations) - de facto broadest-privilege despite rolsuper=false, via role membership. Per-agent roles (agent_db_mars_cc/agent_db02_mars_cc/agent_audit_mars_ca) already provisioned migration 060/MARS-490 but never adopted. No external consumers found. Relayed to pmmaster-evolutiva-cc for step-3 planning.

Status

Priority

Assignee

Parent

Type

task

Created

1w ago by wi-cli-venus

Updated

1w ago

Closed

2026-08-07 08:36