Scenario: a customer sees another company's invoices Advanced

Two hundred companies share one PostgreSQL schema, separated only by a tenant_id column. One of them finds another company’s invoices in its export, but not every time.

You have five decisions: contain, read the code, find out why RLS does not bite, chase an intermittent leak, and keep it fixed.

• The question at every step: which role runs this query, and which tenant does the connection think it is serving?
• Scoring counts only your first choice at each step. The repro numbers come from the scripts in examples/src/row-level-security/ run on PostgreSQL 17.

Scenario

A customer sees another company's invoices, sometimes

You are the backend lead of a B2B invoicing SaaS: 200 companies in one PostgreSQL 17 schema, every table has tenant_id. The API is Node.js with pg.Pool behind PgBouncer in transaction mode. Numbers in this scenario are illustrative.

Known leak paths still open1

Cross-tenant responses / day (estimated)40

Invoice export available100 %

Tenant tables without RLS + FORCE38

Step 1/5 · A ticket from Globex

09:40, the finance manager at Globex (tenant 2) writes: "Our invoice CSV export contained invoices from Acme. It happened twice this week, not every time." She attaches a file with Acme invoice numbers. The export shipped 9 days ago.

affected surface

GET /api/invoices/export.csv

data

invoice numbers, amounts, customer names

reproducible on demand

not yet

What do you do?

ATurn off the export with a feature flag, snapshot the logs, open an incidentflag invoices.export = off; copy 14 days of API and PgBouncer logs to the incident bucketBAsk Globex to clear their browser cache and try againCPut the whole app into maintenance mode until the cause is found

After playing, read Row-level security for multi-tenancy for the policies, the roles that bypass them and the SET LOCAL helper.