Skip to content

Database tables granted to the anon role

Scan rule · RSC-SEC-015

  • Security
  • Severity: Medium
  • CWE-284
  • OWASP A01-2021

Queries the schema endpoint with the client key the app publishes itself and lists the tables granted to the anon role — without fetching a row or a row count. Granted is not the same as readable: whether rows come out depends on Row Level Security.

Scan tier

  • External scan (anonymous)

How to fix it

For each table listed, verify RLS is enabled and the policy scopes access to the individual user.

Scan your own app for free

More rules in this dimension