Medium

public.v_customer_billing bypasses policies on public.invoices, public.customers

Summary

The view reads RLS-protected relations with owner rights, so callers see rows their own policies would exclude.

Views are commonly treated as read-only conveniences, but a non-invoker view is an unmonitored bypass of the table's tenant boundary.

Facts above were derived by the scanner from database metadata. No model output is involved in the verdict.

reloptions does not contain security_invoker=true while the referenced relation has relrowsecurity = true.

Enable invoker rights so the caller's policies apply.

Current

CREATE VIEW public.v_customer_billing AS
  SELECT ... FROM public.invoices;

Proposed

ALTER VIEW public.v_customer_billing SET (security_invoker = true);

Expected security effect

Compatibility risk

low

Callers previously seeing all rows will now see only their own. Dashboards aggregating across tenants need a privileged path.

DBX never applies SQL to your database.