Foreign table is exposed to API roles.
A foreign table places a remote data source behind a local PostgreSQL relation. Exposing that relation can unintentionally turn the Data API into a path to another system.
Detection condition
The rule reports a foreign table in an exposed schema when PUBLIC, anon, or authenticated retains a read or write privilege. Ordered object and default grants, revokes, creation, and drops determine the final state.
Why it matters
Local table policies do not automatically describe the remote system's tenant boundary. Client reads or writes may reach data governed by different identities, filters, or operational assumptions.
Typical remediation
Place foreign tables in an unexposed integration schema and revoke API-role privileges. Publish only the required operation through a validated function or a policy-aware local projection.
sqlrevoke all on table public.partner_accounts from public, anon, authenticated;
alter foreign table public.partner_accounts set schema integrations_private;