41
row-level security
also RLS
Not “are you logged in,” but “is this row yours.” Hide the button and refuse the query.
What is row-level security?
Row-level security enforces per-row access in the database. Application checks are extra. If the API is the only gate, changing an id in the URL is an incident.
Why does row-level security matter when vibe coding?
Models build UIs that hide other people’s rows and forget the query. Vibe-coded SaaS leaks here constantly. Name RLS. Require a test that a second user cannot read the first user’s id.
How do you do row-level security?
Write the failing test first: user B requests user A’s record and gets 404 or 403. Then policies. Then the UI.
How do you ask a model for row-level security?
Enforce row-level security in the database. A user may only read and write their own (objects). Changing the id in the URL must not leak a row. Add a test for that.
What goes wrong with row-level security?
“We’ll add auth later.” Later is after the dump. Later is not a security model.