WilliamACLove/mike-harvey-competition-legal-research-

Security-focused fork patching cross-tenant authorization gaps in Mike's Supabase backend

One security-focused PR addressing three distinct cross-tenant data access paths: blanket RLS enforcement across non-`user_profiles` tables, an accessible-document filter threaded through four tabular review endpoints, and project-scoped validation for folder move operations.

View on GitHub →

WilliamACLove's fork targets a cluster of multi-tenancy bugs: missing Row Level Security on most data tables, insecure document ID handling in the tabular review endpoints, and unchecked folder operations that let project members manipulate structure across project boundaries. The work includes both a one-shot schema update and incremental migrations for live deployments.

What's in it

Tenant isolation Closes three separate paths that could let one client see another client's chats, documents or folder layout.
Backend security focus The work that's been done so far reads as a deliberate sweep through multi-tenant boundaries rather than scattered fixes.

Direction

securitymulti-tenant

Activity

Themed changes and pull requests touching this fork, newest first. Themed changes that haven't been turned into a public post yet still appear — they're real work even without a published writeup.

🟢 #1 Close cross-tenant data leaks: RLS, tabular IDOR, folder scoping +186 -6 3mo ago self by WilliamACLove ↗ analysis ↗ GitHub

## Summary

📝 Three cross-tenant data leaks closed in the Mike backend 0 commits — securitymulti-tenant draft

Threads of work (detailed view)

1 thread have been distilled into posts.

Three cross-tenant data leaks closed in the Mike backend

WilliamACLove's PR patches a trio of authorization gaps that let one tenant read another's documents, chats, and LLM-extracted content. The most blunt problem: only the `user_profiles` table had Row Level Security enabled, leaving every other data table reachable through PostgREST with the anon key shipped in the JS bundle.

securitymulti-tenant

Pull requests (detailed view)

1 PR touch this fork — inbound (filed against it) or outbound (filed from it). State icons match the editorial dashboard.

🟢 Open (1)

🟢 open · #1 Close cross-tenant data leaks: RLS, tabular IDOR, folder scoping

by WilliamACLove · opened 3mo ago

WilliamACLove/mike-harvey-competition-legal-research- ← WilliamACLove/mike-harvey-competition-legal-research- · +186 -6 · self · ↗ analysis · ↗ GitHub