Medium

Policy "Users can view profiles" does not constrain rows to a tenant

Summary

The SELECT policy on public.profiles admits every authenticated caller and never references organization_id.

Any signed-in user can read rows belonging to other organizations, because the policy only proves that a session exists — not that it owns the row.

Facts above were derived by the scanner from database metadata. No model output is involved in the verdict.

pg_policies.qual evaluates to a session-existence check. The table exposes organization_id, which the evaluated path never references.

Scope the policy to organization_id using the tenant resolver.

Current

CREATE POLICY "Users can view profiles"
ON public.profiles
FOR SELECT
TO authenticated
USING (auth.uid() IS NOT NULL);

Proposed

CREATE POLICY "Users can view profiles"
ON public.profiles
FOR SELECT
TO authenticated
USING (
  organization_id = current_tenant_owner()
);

Expected security effect

Compatibility risk

low

Callers relying on reading records outside their organization will start receiving zero rows. Verify admin tooling uses a privileged path.

DBX never applies SQL to your database.