data-isolation-and-lifecycle

Data Isolation and Lifecycle

Overview

Endpoint checks protect one door. Data has many copies — a cache entry, a search document, a thumbnail, an export file, a log line, a backup, a queued job — and each copy has its own reader and its own retention. Isolation fails where a copy forgets who owns the data, or where a deleted or revoked record keeps working.

Core principle: pick one protected record the diff touches and follow it through every write, read, copy and state change. At each edge, name the code that enforces its owner. A tenant column is not that code.

1. A Tenant Field Is Not Isolation (CWE-639, CWE-863)

The owner column exists; the question is which query, policy or key enforces it on this path.

• Bypass clients: Supabase's service-role key or a Postgres role with BYPASSRLS used in a request handler; a "system" repository that skips the tenant filter, called from a user-facing path.
• Unscoped escapes: GORM Unscoped() (it also drops the soft-delete filter), Rails unscoped, a Django manager that is not the filtered default, Hibernate filters that do not apply to native queries, Prisma middleware that a raw query skips.
• Policy and query disagree: row-level security on the table but the new view, function (SECURITY DEFINER), materialized view or aggregate reads around it; a join that brings in rows of another tenant through an unscoped relation.

-- ❌ SECURITY DEFINER runs as the function's owner; a table owner bypasses RLS
--    (unless FORCE ROW LEVEL SECURITY is set), so the caller's policy never applies
CREATE FUNCTION project_stats(p uuid) RETURNS TABLE(...) LANGUAGE sql SECURITY DEFINER
AS $$ SELECT ... FROM tasks WHERE project_id = p $$;
-- ✅ SECURITY INVOKER (the default), or filter on the caller's tenant inside the function

2. Keys and Namespaces Without the Tenant

Two principals collide on one logical key even though their records have separate owners:

• cache keys built from a user-chosen name (report: + name) or from an id that is only unique per tenant;
• object-storage keys from the uploaded filename (uploads/avatar.png) — one tenant overwrites or reads another's;
• search document ids, deduplication keys, idempotency keys and lock names without the tenant;
• globally unique constraints that let one tenant squat or probe another tenant's slug, email or domain.