Skip to content

Scan rule · RSC-SEC-015

Database tables granted to the anon role

SecuritySeverity: MediumCWE-284OWASP A01-2021

Queries the schema endpoint with the client key the app publishes itself and lists the tables granted to the anon role — without fetching a row or a row count. Granted is not the same as readable: whether rows come out depends on Row Level Security.

Scan tier

External scan (anonymous)

How to fix it

For each table listed, verify RLS is enabled and the policy scopes access to the individual user.

Scan your own app for free