Postgres RLS Unique Constraint Leak: Hidden Rows Collide
A Postgres unique constraint ignores row-level security, so a tenant that cannot SELECT a row can still find it by INSERT. Scoping the key to UNIQUE (tenant_id, email) closes it.
#Row-Level Security
Posts tagged Row-Level Security on abchaudary.me.