-
Notifications
You must be signed in to change notification settings - Fork 57
failed_webhook_events table missing RLS policies #161
Copy link
Copy link
Labels
GSSOC26GirlScript Summer of Code 2026GirlScript Summer of Code 2026backendBackend / API / DB relatedBackend / API / DB relatedbugSomething isn't workingSomething isn't workinglevel:intermediateIntermediate level difficultyIntermediate level difficultytype:securitySecurity fix or improvementSecurity fix or improvement
Metadata
Metadata
Assignees
Labels
GSSOC26GirlScript Summer of Code 2026GirlScript Summer of Code 2026backendBackend / API / DB relatedBackend / API / DB relatedbugSomething isn't workingSomething isn't workinglevel:intermediateIntermediate level difficultyIntermediate level difficultytype:securitySecurity fix or improvementSecurity fix or improvement
Type
Fields
Give feedbackNo fields configured for issues without a type.
Problem
The failed_webhook_events table added in the recent migration has no Row Level Security. Any authenticated user can read or write to it directly via the Supabase client.
Fix
Add a new migration:
No user-facing policies needed since this table is only accessed via the service role key. Enabling RLS blocks the anon and authenticated roles by default.