SECURITY DEFINER function has an unpinned search path.
A privileged function can resolve an attacker-controlled object before the intended object when its search path is not constrained.
Detection condition
The rule reports each SECURITY DEFINER function where the final definition does not include a pinned search_path setting.
Why it matters
SECURITY DEFINER runs with its owner's privileges. Unqualified names resolved through a mutable schema can turn object shadowing into privilege escalation or a tenant-boundary bypass.
Typical remediation
Set search_path to an empty or tightly trusted value and schema-qualify every referenced relation and function.
Pin the search path
sqlcreate function public.rotate_key(project_id uuid)
returns void
language plpgsql
security definer
set search_path = ''
as $
begin
update public.projects set key_version = key_version + 1
where id = project_id;
end;
$;