Public policy grants unrestricted row access.
An unconditional policy for anon or PUBLIC can expose every matching row or permit untrusted writes without establishing a tenant relationship.
Detection condition
The rule reports a policy granted to anon, PUBLIC, or an implicit public role when USING or WITH CHECK reduces to the unconditional expression true.
Why it matters
RLS is enabled, but the policy authorizes callers without identity or ownership. For a multi-tenant table, this can become direct cross-customer disclosure or modification.
Typical remediation
Replace the unconditional expression with an ownership or tenant-membership check, and grant the policy only to roles that actually need the operation.
Unsafe policy
sqlcreate policy "public projects"
on public.projects for select
to anon
using (true);