Postmortems
Three real bugs. Found by our own hardening suite.
Not theoretical vulnerabilities from a checklist — bugs that existed in this codebase, in exactly the places multi-tenant SaaS breaks. Each write-up covers the bug, how the attack found it, the fix, and the regression test that ships with the product.
- BUG 01 OF 03
Cross-tenant SECURITY DEFINER: the hole RLS can't fix
Bug 01 from our own hardening suite — RLS was enabled the entire time.
caught by: supabase/tests/hardening/security-definer-boundaries.test.ts · fixed in: 000027_fix_usage_rpc_security.sql
- BUG 02 OF 03
Stripe webhook ordering: how an old event downgraded a paying customer
Bug 02 from our own hardening suite — Stripe delivers at-least-once, never in-order.
caught by: supabase/tests/hardening/stripe-webhook-reliability.test.ts · fixed in: 000026_stripe_event_ordering.sql
- BUG 03 OF 03
Webhook retry poisoning: when idempotency becomes the bug
Bug 03 from our own hardening suite — the recovery path itself was broken.
caught by: supabase/tests/hardening/stripe-webhook-reliability.test.ts · fixed in: 000026_stripe_event_ordering.sql
The suite that found these ships with the product.
Re-run every attack yourself with npm run test:hardening — the details are in the documentation.