Urgent.News

What's breaking now, across thousands of outlets.

More in Tech

Postgres RLS in Symfony: three green isolation tests, and the UPDATE that moves tenant 1's invoices into tenant 2's books

Two articles ago I wrote that the Postgres role which runs your migrations bypasses every row-level security policy. Last week I wrote that with one tenant in the fixture, your isolation suite passes…

  • Postgres role bypasses row-level security policies during migrations
  • Tenant 1 can move all invoices into tenant 2's books with one SQL statement
  • Fixing policy allows security hole for tenant 1 to move invoices

More from Monday 14 September →