Rule index: all nine shipped rules

Catalog rules

Seven rules evaluate the schema snapshot taken by a connected scan:

RLS_DISABLED (critical) — a table reachable through PostgREST with Row Level Security switched off. Documentation: /docs/rules/rls-disabled.

RLS_TAUTOLOGY (critical) — a permissive policy whose condition is constant true, so the table reads as protected everywhere while standing open. Documentation: /docs/rules/permissive-policy.

RLS_NO_POLICIES (high) — RLS enabled with zero policies, denying every row to non-owner roles. Documentation: /docs/rules/rls-no-policies.

MISSING_WITH_CHECK (high) — an INSERT, UPDATE or ALL policy with nothing constraining what gets written. Documentation: /docs/rules/missing-with-check.

PUBLIC_BUCKET_EXPOSURE (high, escalating to critical) — a public storage bucket, an open storage.objects policy, or RLS switched off on storage.objects itself. Documentation: /docs/rules/public-bucket-exposure.

UNINDEXED_RLS_PREDICATE (medium) — a policy filtering on a column with no valid index, degrading each affected query toward a sequential scan. Documentation: /docs/rules/unindexed-rls.

RLS_UNWRAPPED_AUTH_CALL (medium) — a bare auth.uid() re-evaluated once per candidate row where wrapping it would hoist the cost. Documentation: /docs/rules/unwrapped-auth-uid.

Probe rules

Two rules evaluate the public surface reached by the probe:

SERVICE_ROLE_KEY_EXPOSED (critical) — the RLS-bypassing service_role key, or a management token, discovered in a client-facing bundle. Documentation: /docs/rules/service-role-exposure.

ANON_TABLE_READABLE (critical) — a table that returned rows to an unauthenticated request carrying only the anon key. Documentation: /docs/rules/anon-table-readable.

Where findings come from

Rules fire per object and are keyed accordingly, so one table can carry several findings from different rules while one broken policy yields exactly one finding.

The documentation pages linked above are generated from the shipped rule catalog itself, so they cannot drift from what actually runs; this summary exists to save you nine clicks, and every entry defers to its documentation page as the source of truth.