SECURITY DEFINER function remains executable by PUBLIC.
A safe function body is not enough when every database role may invoke a privileged operation by default.
Detection condition
The rule reports each SECURITY DEFINER function where final migration state contains no explicit REVOKE EXECUTE ... FROM PUBLIC for that function signature.
Why it matters
PostgreSQL grants function execution to PUBLIC by default. A privileged helper intended for one service role can therefore become reachable by application or anonymous roles unless execution is revoked and re-granted deliberately.
Typical remediation
Revoke PUBLIC execution for the exact function signature, then grant execution only to the narrow roles that require it.
Restrict execution
sqlrevoke execute on function public.rotate_key(uuid) from public;
grant execute on function public.rotate_key(uuid) to service_role;