RowAttest Attestation Report
RA-SAMPLE0001 · SAMPLE
Sample. Synthetic data throughout. “Tasklio” is a fictional demo application built by RowAttest to show the report format. Names and identifiers are placeholders; the signature in the block below is a real Ed25519 signature over this excerpt's canonical JSON, made with a demo key.
1 · Header
- Project ref
- tasklio-demo (fictional)
- Environment
- declared as staging by the customer
- Run window (UTC)
- 2026-09-18 14:02:11 → 14:09:47
- Engine
- v0.1.0-sample
- Issued by
- RW Digital Ventures LLC (RowAttest)
2 · Executive summary
1 of 93 evaluated boundaries failed: a seeded attacker in one tenant could reach another tenant's data. Details in the findings section.
92
Pass
1
Fail
12
Not evaluated
0
Error
Coverage: 7 of 8 tables evaluated (84 cells) plus 1 storage bucket (9 cells); 1 table not evaluated (12 cells, unknown tenancy).
3 · Tenancy model (as inferred)
| Table | Classification | Confidence | Basis |
|---|---|---|---|
| organizations | tenant root | High | Referenced by org_id across schema |
| memberships | membership table | High | Joins user_id and org_id |
| projects | tenant-scoped | High | org_id column + policy references auth.uid() via membership |
| tasks | tenant-scoped | High | org_id column + policies on SELECT/INSERT/UPDATE/DELETE |
| comments | tenant-scoped | High | org_id column |
| profiles | user-owned | High | user_id = auth.uid() policy |
| plan_catalog | shared-reference | Medium | No tenant column; read-only policy for all authenticated |
| analytics_events | unknown | — | No tenant or owner column detected. Not evaluated. RowAttest does not guess. |
If a classification is wrong, correct it in the dashboard; the next run uses your correction.
4 · Isolation matrix (excerpt)
| Table · operation | anon | attacker (tenant B) | second user (tenant A) |
|---|---|---|---|
| projects · SELECT | PASS | PASS | PASS |
| projects · INSERT | PASS | PASS | PASS |
| tasks · SELECT | PASS | PASS | PASS |
| tasks · UPDATE | PASS | FAIL → F-1PASSedited | PASS |
| comments · DELETE | PASS | PASS | PASS |
| profiles · SELECT | PASS | PASS | PASS |
| analytics_events · all | NOT EVALUATED | NOT EVALUATED | NOT EVALUATED |
| bucket attachments · read | PASS | PASS | PASS |
5 · Finding F-1 · cross-tenant UPDATE on tasks
- What was accessed
- A task row belonging to tenant A (synthetic row rowattest_synthetic_task_a1) was modified by a user in tenant B
- As whom
- Seeded user attacker-b1@rowattest-seed.example (tenant B, role: member)
- Reproduction
- PATCH /rest/v1/tasks?id=eq.<synthetic-id> with tenant-B access token, header Prefer: return=representation; body {"title": "changed-by-b"}
- Evidence
- HTTP 200; response body contains the modified row (1 row returned, synthetic row only)
- Detected by
- Layer A (API) and Layer B (policy simulation), both agree
- Fix direction
- The UPDATE policy on tasks checks membership in USING but has no WITH CHECK, and the USING clause does not compare org_id. Add an org_id membership check to both clauses.
6 · Static findings
| Rule | Severity | Object | Meaning |
|---|---|---|---|
| rls_disabled_in_public | ERROR | analytics_events | RLS is not enabled on a table exposed through the API |
| security_definer_view | WARN | org_dashboard_view | View runs with owner privileges; confirm it cannot leak cross-tenant rows |
7 · Coverage statement
- analytics_events: NOT EVALUATED. No recognizable tenancy pattern (12 matrix cells). RLS is also disabled on it (static finding above); enabling RLS and adding a tenant column would bring it into scope.
- Supported patterns this run relied on: tenant-column model (org_id) and membership-table model.
- A PASS applies only to the checks listed in this report, at the time of this run, against the schema as it existed then.