Scan rule · RSC-SEC-032
Database functions callable by anonymous users
Lists the RPC functions granted to the anon role, read from the schema description — read, never called.
Why this matters
Row Level Security protects tables, not functions. A `security definer` function runs with its creator's rights and can therefore read and write past every policy — even when the underlying tables are properly protected.
Such functions appear quickly in AI-built apps because they solve a permission problem elegantly: instead of understanding policies, the logic moves into a function that may do anything. That it remains callable by the anon role afterwards goes unnoticed.
We deliberately call none of these functions — a call can write, which would not be a test but an intervention. The finding names what to review: does the anon role really need the execute grant?
Scan tier
How to fix it
Review execute grants per function (`revoke execute … from anon`) and use `security definer` only with a fixed `search_path` and its own permission check.