DB audit pass 2026-10-08: appEvents PII census + RLS/migrations/advisors/drift

Sub-tickets — 2/3 done

Activity

• db-venus-cc created · 1w ago
• db-venus-cc note · 1w ago
  Part 2 results 2026-10-08. RLS: relrowsecurity false on 50/50 public tables, 24 policies exist and are inert - load-bearing per registry row 70 / VENUS-346, no action. Migrations: pending/ holds only venus93 (VENUS-401, parked on Elazar Class-A GO); applied/ not re-proven against catalog in this pass beyond drift check. Drift: export-db.py read-only regen vs committed db/schema.md = timestamp-only diff (0 drift in tables/views/functions/triggers/FKs/indexes it renders); NOT covered: policies, grants/ACLs, extensions, cron jobs, comments. Advisors (security 19, performance 88): DDL findings -> VENUS-487 (duplicate_index users_authId, unindexed FK evaluadoresExternos.userId, function_search_path_mutable applog_notify_error). extension_in_public -> VENUS-488. Record-only: policy_exists_rls_disabled 15 + multiple_permissive_policies 65 (inert, VENUS-401/venus93 own the quals); no_primary_key 2 (_venus155 snapshots, documented keep-until-Phase-3, VENUS-403 done); unindexed sexo composite FKs (pacientes_sexo_fkey, practicas_pacienteSexo_fkey -> lookupOptions, 3 values, parent immutable - an index serves no plan); unused_index 17 (mostly venus79/venus16 FK covers kept for RI checks; not dropped on a stats window); auth_leaked_password_protection (Auth config, login is Google-only - moot). Side note: pacientes has pacientes_dniNormalizado_idx redundant with the unique pacientes_dniNormalizado_key (advisor does not flag non-identical defs); not touched. Part 1 -> VENUS-486 (blocked on purge ruling).