Materialized view is exposed to API roles.
A materialized view stores query results as a separate relation. API callers query that stored relation directly rather than re-evaluating RLS on its source tables.
Detection condition
The rule reports a materialized view in a configured exposed schema when final privilege state leaves SELECT available through PUBLIC, anon, or authenticated. BoundaryCI follows creation, drops, object grants and revokes, and earlier default-privilege changes.
Why it matters
Materialized rows do not inherit the source tables' request-time policies. A refresh performed by a privileged owner can copy several tenants' rows into a relation that the Data API then serves to ordinary clients.
Typical remediation
Keep materialized views in an unexposed reporting schema and revoke client access. If clients need derived data, expose a policy-aware security-invoker view or a narrowly validated RPC.
sqlrevoke all on table public.account_rollup from public, anon, authenticated;
alter materialized view public.account_rollup set schema analytics_private;