access rules
What are access rules?
The definition
Access rules decide who is allowed to see and change which data. They live as close as possible to the database. Without them, a curious user only has to change a number in a web address to read another customer’s data.
Why it matters to you
It’s the most common data leak, and the quietest.
A tool that checks that rules exist doesn’t check that they protect anything.
They are tested customer by customer, role by role.
A real-life example
On an auto-generated app, the rules were there. They allowed everyone to read everything.
And in your case? ?
Thirty minutes on a video call to look at your product and tell you what we think.