Security Audit

Database security auditor specialized in Row Level Security (RLS) enforcement, Zero-Trust database architecture, and forensic audit trails. Focuses on Supabase, Postgres, and Convex data layer security. For general application security (OWASP Top 10, auth patterns, security headers, input validation), use the security skill instead.

Quick Reference

Audit Protocol

Follow this sequence when performing a database security audit:

1. Attack Surface Mapping: Identify all entry points to the data layer (public APIs, internal dashboards, AI agents, cron jobs)
2. RLS Coverage Check: Query pg_tables to verify every public schema table has RLS enabled and appropriate policies
3. Policy Review: Check for logical bypasses, missing WITH CHECK clauses, overly permissive FOR ALL policies
4. Service Role Audit: Search client code for service_role key exposure; verify it only appears in server-side code
5. Function Audit: Check for security definer functions in exposed schemas and Convex functions missing auth guards
6. Access Simulation: Execute queries as anon and authenticated roles to verify enforcement
7. View Audit: Verify views use security_invoker = true or are not in exposed schemas
8. Audit Trail Verification: Confirm triggers or PGAudit capture all security-relevant operations
9. Compliance Validation: Map database controls against applicable regulatory frameworks

Security Principles

Anti-Patterns

Common Mistakes

Relationship to Security Skill

The application-security skill covers general application security: OWASP Top 10, authentication patterns, input validation, security headers, and compliance overviews. This database-security skill complements it by focusing on database-layer concerns: RLS policy design and performance, Supabase/Postgres-specific patterns, Convex auth guards, PGAudit configuration, and database-specific compliance implementations (SQL functions for GDPR erasure, HIPAA PHI audit triggers, etc.).

Delegation

• Verify RLS enforcement with access simulations: Use Task agent to run anonymous and authenticated queries against every public table
• Audit Convex functions for missing auth guards: Use Explore agent to scan all query and mutation handlers for getUserIdentity calls
• Design zero-trust database architecture: Use Plan agent to map schemas, access policies, JIT grants, and audit log design
• Generate database compliance evidence: Use Task agent to run audit queries and produce compliance reports

References

• rls-performance.md -- RLS policy performance, initPlan caching, stable functions, separate policies, EXPLAIN benchmarking
• zero-trust-database.md -- Micro-segmentation, identity propagation, connection security, JIT access controls
• audit-logging.md -- Trigger-based auditing, PGAudit extension and log classes, log integrity, tamper-proof storage
• convex-security.md -- Identity validation, manual RLS in functions, granular functions, role-based access via JWT claims
• threat-modeling.md -- STRIDE applied to database access, RLS bypass vectors, data layer trust boundaries
• application-security.md -- Service role management, schema exposure, security definer functions, views and RLS
• compliance-frameworks.md -- Database-specific GDPR, HIPAA, SOC2, PCI-DSS requirements and SQL implementations