Harden webhook route RLS policies

[vincentgrobler]

Summary

• remove the role-less service policies that applied to PUBLIC on output_routes and webhook_logs
• restrict user-facing policies to the authenticated role and apply least-privilege table grants
• remove credential-bearing output_routes rows from the Realtime publication because the application has no subscriber
• replace the bouncing security-reporting address in SECURITY.md with the working team inbox

Security impact

Migration 021 created permissive policies without a TO clause. PostgreSQL therefore applied them to PUBLIC, allowing the unconditional route-read policy to override the workspace-scoped SELECT policy and making the log INSERT policy available to client roles.

The production policies have already been removed as an emergency hotfix and anonymous route visibility was verified to return zero rows. Migration 084 makes that containment durable across deployments and adds defence-in-depth role and grant restrictions. The backend remains functional because Supabase service_role bypasses RLS.

Validation

• npm run build
• npx vitest run src/lib/utils.test.ts — 3 tests passed
• cd task-runner && npm run build
• cd task-runner && npx vitest run src — 18 tests passed
• production verification as anon: select count(*) from public.output_routes returned 0 after containment

Operational follow-up

Credential rotation and historical log review are tracked as incident-response follow-up and are intentionally separate from this code change.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
crewform	Ready	Preview	Aug 8, 2026 9:30am