Draft for review. Statuses and facts are being verified before publication.
KuraplanTrust Center
Controls

Infrastructure security

Database functions and views locked to the server

In placeCriticalVerified 15 September 2026ST4S S4, S8, A13

What this control means

Functions and views that bypass row-level security can be used only by the server role, never by anonymous or signed-in browser sessions. New tables, views and functions are private to the server by default. Verified by probing the public API after the fixes on 15 September 2026.

What we found

During this review we found that several server-only database functions and views could be reached with the public browser key. They were locked to the server role the same day and re-tested.

How we verified it

  1. Listed every function and view that runs with elevated rights and checked which roles could use it.
  2. Confirmed from the codebase that only the server (service role) ever calls them.
  3. Revoked browser-role access, removed two obsolete functions, and set database defaults so new objects are private to the server unless explicitly opened.
  4. Re-ran the same requests with the public key: every one now returns permission denied. The server's own calls continued to succeed.
  5. Reviewed seven days of API logs: no requests to the affected objects from anyone other than our own test.
  6. Recorded both items in the incident register.

Evidence (private, draft only): kuraplan-st4s-evidence/02-access/2026-09-15-FINDING-anon-executable-definer-functions.md

Questions about this control: security@kuraplan.com