Scan rule · RSC-SEC-033
Signup open, accounts confirmed instantly
Reads the anonymously available auth configuration: self-signup open and email confirmation disabled.
Why this matters
Open signup is not a defect; for many products it is the point. It becomes a risk in combination: if accounts are valid instantly without confirmation and access rules only check “is signed in”, one self-registration is enough to reach everyone else's data.
This pattern is widespread in AI-built apps because `using (auth.role() = 'authenticated')` is the first policy that works. It reads like protection but is just a door with a doorbell.
We only read the configuration the sign-in screen fetches itself — no account is created. Fix: enable confirmation and scope every policy to the user (`auth.uid() = user_id`).
Scan tier
How to fix it
Enable email confirmation or close signup — and bind every policy to `auth.uid()` instead of the `authenticated` role.