Scan rule · RSC-SEC-015
Database tables granted to the anon role
SecuritySeverity: MediumCWE-284OWASP A01-2021
Queries the schema endpoint with the client key the app publishes itself and lists the tables granted to the anon role — without fetching a row or a row count. Granted is not the same as readable: whether rows come out depends on Row Level Security.
Scan tier
External scan (anonymous)
How to fix it
For each table listed, verify RLS is enabled and the policy scopes access to the individual user.