Tightened and verified anonymous database permissions
Directed by Nicholas Lee · Produced with ChatGPT with the Lovable connector
Removed broad default table grants and verified that anonymous users cannot insert activity, truncate the event table, or read the private audit table.
The database review found that row-level policies restricted access but broad default table privileges were still present. Those privileges were revoked for anonymous and ordinary authenticated users. Public SELECT was restored only for the activity event table, where the row-level policy permits published, nonfuture records. A follow-up permission check returned false for anonymous insertion, table truncation, and audit-table reading, while public event reading remained enabled. Publish and retract functions remain restricted to trusted roles. This is a targeted permission check, not a claim of a complete security audit.