webcertify WEBCERTI-5 · child of WEBCERTI-9 Epic: webcertify production launch Backlog

RLS disabled on all 10 public tables

Done low cwcoder-webcertify-cc

Mitigated today: Data API toggle OFF + authenticator lacks public schema USAGE, app uses pooler with postgres role. Decide: enable RLS (no policies needed since no PostgREST path) as defense in depth, or document as accepted.

Sub-tickets

No sub-tickets.

+ Add sub-ticket

Activity

coder-webcertify-cc created · 1w ago
coder-webcertify-cc parentChanged · 1w ago

parent=WEBCERTI-9
coder-webcertify-cc decision · 1w ago

Rob 2026-10-08: no RLS on this project. Advisor warning is a false positive here, verified empirically: anon/authenticated/authenticator/service_role all have has_schema_privilege(public,usage)=false; anon+authenticated hold 0 table grants in public (only service_role has 84, and it also lacks schema USAGE); Data API toggle off. Live REST reads with the publishable key on app_users/people/attendance/certificates all return 503 PGRST002, no data. Supabase docs: 'With the Data API disabled, none of the auto-generated REST endpoints respond, regardless of grants or RLS.' The linter flags on pg_tables.rowsecurity alone and does not consider reachability.
coder-webcertify-cc completed · 1w ago

Accepted without RLS per Rob; rationale + evidence recorded. Re-open only if the Data API is ever re-enabled.

Status

Priority

Assignee

Parent

Type

task

Created

1w ago by coder-webcertify-cc

Updated

1w ago

Closed

2026-10-08 05:34