Tenantcheck’s shape-blind Postgres audit

Field notes

Postgres combines permissive row-level-security policies with OR, so a valid tenant-scoped policy does not neutralize a second, broader grant. The write-up traces twelve policies across ten tables to a SECURITY DEFINER helper that returned assigned users without checking organisation boundaries. The author reports testing a supervisor linked across tenants inside a transaction that was rolled back; the test measured four-figure cross-tenant row access before the fix and zero afterward.