A public table endpoint can return HTTP 200 with an empty JSON array. That proves reachability, not data exposure.
The useful question is whether the policies return the right rows for each identity.
A small verification matrix
Test the same read-only query as:
- an anonymous visitor
- the row owner
- an authenticated non-owner
- a service role, kept strictly server-side
For every path, record the status, row count, and whether returned records belong to the expected tenant. Repeat the matrix after each migration.
What the result means
An empty anonymous result can be exactly correct. A non-owner receiving another tenant's row is evidence of a policy problem. Treat those as different findings.
Do not use destructive test queries against production. Start with read-only checks in a controlled environment and document what was tested.
You can run a free, read-only RLS check at https://rowshield.dev/audit
The check is evidence, not a guarantee: application logic, privileged server paths, and changes made after the test still need review.
Top comments (0)