Add RLS to all content beyond user profiles
ryanmcdonough/mike
A security-minded Mike fork tightening who can create chats and access project-linked content.
ryanmcdonough's fork centres on a practical trust boundary: chats should not be attachable to projects a signed-in person cannot access. For a legal-practice product, that is the kind of safeguard users expect to be invisible until it matters.
The broader direction is toward stronger, database-backed separation of content between users or clients. ryanmcdonough also explored extending those protections across the application's content, though that wider proposal did not land.
What's in it
- Safer project-linked chats Checks that a person creating a chat is allowed to use the selected project.
- Content access hardening Explores broader row-level protections so content stays within the right account or client boundary.
- Multi-tenant safeguards Focuses on preventing one authenticated user from reaching another party's project material.
Direction
securitymulti-tenant
Activity
⛔ #2 Enhance chat creation endpoint to check project access using user email +8 6mo ago by
ryanmcdonough ↗ analysis ↗ GitHub Fix Issue #1
📝 ryanmcdonough closes a hole in who can touch your projects 1 commit 6mo ago securitymulti-tenant draft
An authenticated user could quietly attach chats to projects they were never allowed to see - ryanmcdonough shut that door.
📝 RLS sweep across all content tables - closed without merging 0 commits — securitymulti-tenant draft
ryanmcdonough opened a PR to extend row-level security beyond user profiles to every other content table in the schema. The intent was a database-layer authorization sweep rather than a targeted fix. The PR was closed on…
Threads of work (detailed view)
ryanmcdonough closes a hole in who can touch your projects
An authenticated user could quietly attach chats to projects they were never allowed to see - ryanmcdonough shut that door.
POST /chat/create now checks project access before inserting
ryanmcdonough patches an authz hole in `POST /chat/create`: the endpoint previously accepted any `project_id` from the request body and inserted a chat row without verifying the caller had access to that project. Eight lines close it. Upstream willchen96/mike still has the gap.
RLS sweep across all content tables - closed without merging
ryanmcdonough opened a PR to extend row-level security beyond user profiles to every other content table in the schema. The intent was a database-layer authorization sweep rather than a targeted fix. The PR was closed on 2026-05-08 without merging, and no explanation was left.
Pull requests (detailed view)
⛔ Closed without merge (2)
by
ryanmcdonough · opened 6mo ago · closed 6mo ago by
ryanmcdonough · opened 6mo ago · closed 6mo ago