Twelve deterministic checks for migration-time tenant boundaries.
Each BoundaryCI rule has a narrow, reviewable condition. Findings include the final-state evidence, migration location, severity, and a specific remediation.
Rule reference
BND001highExposed table does not enable row-level security
Finds tables in an exposed schema when no ENABLE ROW LEVEL SECURITY statement remains in the final migration state.
Read ruleBND002mediumRLS-enabled table has no policies
Finds RLS-protected tables with no remaining policy, which normally denies client access and often signals an incomplete migration.
Read ruleBND003criticalPublic policy grants unrestricted row access
Finds unconditional USING (true) or WITH CHECK (true) policies granted to anon or PUBLIC callers.
Read ruleBND004highAuthenticated policy is not tenant-scoped
Finds unconditional policies that authorize every signed-in user without proving membership in the active tenant.
Read ruleBND005highSECURITY DEFINER function has an unpinned search path
Finds privileged PostgreSQL functions that do not pin search_path to trusted schemas and schema-qualify referenced objects.
Read ruleBND006highSECURITY DEFINER function remains executable by PUBLIC
Finds privileged functions where migration history never revokes PostgreSQL's default PUBLIC execute privilege.
Read ruleBND007highExposed view may bypass underlying row-level security
Finds views in exposed schemas that do not use security_invoker and may apply the view creator's privileges instead of the caller's.
Read ruleBND008highRLS policy trusts user-editable authentication metadata
Finds authorization expressions that trust user_metadata or raw_user_meta_data, which users can modify through authentication APIs.
Read ruleBND009highMaterialized view is exposed to API roles
Finds materialized views that store query results in exposed schemas and remain selectable by anonymous or authenticated API callers.
Read ruleBND010highForeign table is exposed to API roles
Finds foreign tables that make external data sources reachable through an exposed Supabase Data API schema.
Read ruleBND011mediumDefault privileges automatically expose future objects
Finds ALTER DEFAULT PRIVILEGES grants that give API roles automatic access to future relations or functions.
Read ruleBND012highSECURITY DEFINER function is executable by API roles
Finds privileged functions in exposed schemas that remain directly executable by anon or authenticated after PUBLIC execution is revoked.
Read ruleWhat deterministic means
These rules do not ask a model to decide whether a pull request passes. The same ordered migrations and configuration produce the same finding set. Optional semantic review remains advisory unless a team explicitly changes that behavior.
Rules evaluate final migration state
BoundaryCI accounts for later policy changes, relation drops, function replacements, object grants, revokes, and default privileges. This avoids reporting a dangerous statement that a later migration already removed while still catching a safe object that was later exposed.