I fuzzed my own Supabase RLS — and found a cross-tenant leak (opens in new tab)

Row-Level Security is the kind of thing that looks done. The policies are there, the app works, your tests are green. So you move on. The problem is that your tests test your code — they never test the policies. And RLS is remarkably easy to get subtly wrong: a USING clause with no matching WITH CHECK, so reads are locked down but writes aren't a FOR ALL where you meant FOR SELECT a forgotten ENABLE ROW LEVEL SECURITY on one table out of forty a service_role key that quietly bypasses everythi...