Exposed table does not enable row-level security.
Without RLS, grants and API exposure can allow callers to reach rows without a per-tenant database policy.
Detection condition
The rule reports a declared table in a configured exposed schema when ordered migration state contains no remaining ENABLE ROW LEVEL SECURITY statement. Ignored shared tables are excluded explicitly through configuration.
Why it matters
A shared-schema SaaS table can contain rows for many customers. If the table is reachable through an exposed API or application role, missing RLS removes the database's tenant-aware authorization layer.
Typical remediation
Enable RLS and add least-privilege policies for every operation the application needs. Enabling RLS alone is not a complete authorization design.
Enable RLS
sqlalter table public.projects enable row level security;