RLS-enabled table has no policies.
RLS with no policy normally denies client access. That can be intentional for server-only data, but often signals an incomplete migration or outage risk.
Detection condition
The rule reports an exposed table when final migration state enables RLS but contains no remaining CREATE POLICY definition for that table.
Why it matters
A deny-all table may break legitimate application paths. Teams sometimes respond under pressure by adding an overly broad policy, turning an availability incident into an authorization weakness.
Typical remediation
Add explicit least-privilege policies, or document and ignore a table that is intentionally accessible only through a trusted server role.
Add a tenant-correlated policy
sqlcreate policy "members read projects"
on public.projects for select
to authenticated
using (organization_id = public.active_organization_id());