Postgres RLS Unique Constraint Leak: Hidden Rows Collide
A Postgres unique constraint ignores row-level security, so a tenant that cannot SELECT a row can still find it by INSERT. Scoping the key to UNIQUE (tenant_id, email) closes it.
#Multi-Tenancy
Posts tagged Multi-Tenancy on abchaudary.me.