Problem guide
RLS and tenancy failures
If Row Level Security is off, or the only check is a user id the browser sent, one account can read another's rows. We see it constantly on Supabase and Firebase apps. Policies and server-side authz come before new features.
What to do
- Turn RLS on and test it for every table that holds user data
- Stop trusting a user id that came from the client
- Add a test that proves cross-tenant reads and writes fail
- Check storage buckets and public URLs
- Write the tenancy model down so the next AI edit has something to follow
A tenancy bug fails diligence and loses the customer who notices. The audit always includes a cross-tenant read and write.
Rescue by tool
FAQ
Can Meridian help with rls and tenancy failures?
Yes. Bring it as a diagnostic. We will rank how bad it is and, if salvage makes sense, quote a fixed scope.
See also pricing and rescue vs rewrite.
If the app is stuck, start with a diagnostic.
Tell us what you built and what is in the way. Written scorecard within about 48 hours of access.