fix(db): restrict anon/authenticated read on counterfeit_reports to non-PII columns - #4209
Merged
dipexplorer merged 1 commit intoAug 8, 2026
Conversation
…on-PII columns The reports_public_read policy granted anon/authenticated SELECT USING(true) over all columns of counterfeit_reports. Since the anon key is embedded in client-side code, anyone could query PostgREST and exfiltrate reporters' phone numbers, street addresses, pincodes, and exact GPS coordinates, including pending/unverified reports (PII breach RatLoopz#4200). Drop the permissive policy, revoke table-level SELECT for client roles, and re-grant only the non-PII display columns (brand, manufacturer, district, status, timestamps, photos, etc.). service_role API flows are unaffected. Add pgtap RLS test asserting anon can read only non-PII columns and is denied reporter_phone/address/pincode/report_location.
github-actions
Bot
added
gssoc:approved
|
dipexplorer
added
level:critical
github-project-automation
Bot
moved this from 📥 Backlog
to 🎉 Merged
in SahiDawa Workflow
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
🛑 STOP: Assignment & File Scope Check
Warning
PRs with unrelated files will not be reviewed and may be closed.
📋 PR Summary & Link
The reports_public_read policy granted anon/authenticated SELECT ... USING (true) across every column of counterfeit_reports. Because the anon key is embedded in the web client (apps/web/lib/supabase.ts), anyone could hit the PostgREST REST API and exfiltrate reporters' phone numbers, full street addresses, pincodes, and exact GPS coordinates—including pending/unverified reports.
Changes:
supabase/migrations/20260807000000_restrict_reports_public_read.sql
Drops reports_public_read.
Revokes table-level SELECT for anon/authenticated (so column grants take effect).
Re-adds a row policy and grants SELECT only on non-PII display columns (id, reported_brand_name, manufacturer, description, pharmacy_name, city, state, photo_url, photo_urls, district, status, created_at).
Blocks reporter_id, reporter_phone, address, pincode, report_location, and internal safety fields.
supabase/tests/rls/counterfeit_reports_public_read.test.sql — pgtap test asserting anon can read non-PII columns but is denied (42501) reporter_phone, address, pincode, report_location.
Safety: service_role (API server) bypasses RLS and column grants, so submit, /mine, and admin list flows are unaffected.
🏷️ PR Type
type: bugtype: featuretype: docstype: testingtype: securitytype: performancetype: designtype: refactortype: devopstype: accessibility✅ Checklist
Closes #4200)mainand resolved any conflicts