Enabling RLS doesn’t tell you whether the permissions are right. We check which data each user can read or change, including through functions, views and server code.
Write down who may do what
We list resources and the operations allowed for visitors, users, team members and administrators. Those rules let us compare the intended permissions with the actual behaviour.
- Individual ownership and workspace membership
- Role changes, invitations and account lifecycle
- Background jobs and administrative operations
Review policies and other data access
We check grants, RLS, views and exposed functions. We distinguish publishable keys from privileged credentials and check where they’re used. Storage and backend access are included where relevant.
Test accounts with different permissions
We use agreed test accounts and data to verify that allowed operations succeed and prohibited ones are blocked. After a policy change, we repeat the affected cases.
Document checks for future releases
A new table or function can change data access. We leave cases to repeat after migrations, including query checks where policies might affect performance.
Before we start
Is enabling RLS enough to protect my data?
Enabling RLS does not establish that the policies match your product rules. We also check roles, allowed operations and access through functions and server code, using agreed test accounts.
Should I send you the service role key?
Not in the contact form or the first message. We agree on the scope and access first. Any credentials needed for the work are handled through an agreed process with limited privileges.
Updated