Default privileges automatically expose future objects.
A secure object can become the exception while every future table or function is exposed automatically. The mistake may remain invisible until a later migration creates sensitive data or a privileged RPC.
Detection condition
The rule reports final ALTER DEFAULT PRIVILEGES grants on tables or functions for PUBLIC, anon, or authenticated when they apply globally or to a configured exposed schema. A later matching revoke removes the finding.
Why it matters
Default grants silently widen the API surface of future migrations. RLS can still constrain tables, but accidental functions, views, materialized views, and foreign tables may become reachable before their privilege model is reviewed.
Typical remediation
Revoke client-facing defaults and grant privileges explicitly on reviewed API objects. Keep internal relations and helper functions in schemas the Data API does not expose.
sqlalter default privileges in schema public
revoke all on tables from public, anon, authenticated;
alter default privileges in schema public
revoke execute on functions from public, anon, authenticated;