Scan rule · RSC-SEC-070
Signed-in strangers read other people's records
SecuritySeverity: HighCWE-639OWASP A01-2021
After domain verification, creates a throwaway account and counts how many rows that stranger sees in personal-data tables — without fetching a single row.
Scan tier
Active (after domain proof)
How to fix it
Change policies to `auth.uid() = user_id` instead of `auth.role() = 'authenticated'`, then re-check.