Database functions callable without logging in

A SECURITY DEFINER function runs with the privileges of whoever created it — usually a superuser — so Row Level Security does not apply inside it. A function written to be called by your logged-in UI becomes a route around every policy you wrote.

Nothing about it looks alarming in the dashboard, which is why this is worth checking deliberately.

Is it SECURITY DEFINER or SECURITY INVOKER? Prefer INVOKER unless you specifically need otherwise, because INVOKER respects RLS.

If it must be DEFINER, it has to validate auth.uid() itself before touching any data — the policies will not do it for you.

And revoke anything that should not be reachable anonymously:

REVOKE EXECUTE ON FUNCTION public.promote_user FROM anon;