critical
Invoices readable across tenants
RLS-004SELECT policy trusts a client-provided workspace_id instead of the authenticated membership.
public.invoices SCAN COMPLETED · 2M 14S
Security posture
Authorization boundaries across your Supabase database, API routes, and storage.
72/100
Elevated risk
Three issues need attention before launch.
The tenant boundary is sound in 18 of 21 checks. Fix the invoice policy first—it is directly exploitable with an authenticated account.
Priority findings
Ordered by exploitability and potential impact.
high
Service role exposed in route handler
KEY-002A privileged key is initialized in a module imported by the client bundle.
app/api/export/route.tsmedium
Storage policy skips ownership check
STO-007Authenticated users can overwrite objects when they know the storage path.
tenant-documents