What this control means
New users and roles have no access to any other user's data until explicitly granted by row-level security policy.
What we found
Browser roles get no access to any table, view or function unless a policy or grant says so. Over-broad anonymous policies found in the review were removed the same day.
How we verified it
- Confirmed the server-only key is never referenced in browser code and no public environment variable carries a secret.
- Set database default privileges so every new object is private to the server.
- Reviewed all 57 policies that grant to anonymous or public roles, one by one.
- Removed seven that allowed anonymous read or write on contact form submissions, image records, video search history and lead records. All callers are server-side.
- Re-tested with the public key: each table now returns nothing to anonymous callers. Seven days of API logs show no outside access.
- 16 September: removed browser-role write access to the users table, removed truncate and trigger privileges that browser roles held on 76 tables, locked an admin function that was callable with the public key, and removed a storage policy that let the public key upload files.
Still to do
- Publish the written default-deny statement in the security policy.
Evidence (private, draft only): kuraplan-st4s-evidence/02-access/2026-09-15-service-role-key-scope.md
Questions about this control: security@kuraplan.com