Access audit of baresql_fx_saas

26 October 2026, 12:00 UTC · PostgreSQL 16.15 (Ubuntu 16.15-0ubuntu0.24.04.1) · 4 logins · BareSQL 0.1.0

1high

1medium

1low

4logins that read personal data

5columns with personal data

BareSQL logged in as postgres (a superuser) over an unencrypted connection and read the system catalogs inside one read-only transaction. It read up to 200 rows of each table to see what the columns hold; the values were looked at in memory and are not in this report. For every login, the server's own privilege checks were asked about every table and column, and each answer below comes with the grant, membership, ownership or view that gives it.

Findings

HIGHView support.ticket_context reads app.accounts, app.tickets with rights that skip row security, so these logins see every row: saas_agent.

view-bypasses-row-security · support.ticket_context

MEDIUMRow security on app.audit_log is not forced and its owner saas_migrator can log in: sessions logged in as saas_migrator see every row.

rls-owner-login · app.audit_log

LOWRow security is on for app.api_keys but it has no policies: only its owner and roles that bypass row security see any rows.

rls-no-policies · app.api_keys

Who can read personal data

Login	Personal data	Columns	Tables	Changes	Notes
saas_admin_app	email addressperson's namephone numberkey, token or secret	4	2	0	bypassrls
saas_app	email addressperson's namephone number	3	1	1
saas_agent	email addressperson's name	2	1	0
saas_migrator	email address	1	1	1

Columns and tables count base tables, partitions and materialized views, reached in any way listed below. Changes counts tables with personal data the login can insert into, update, delete from or empty.

Personal data in this database

Column	Holds	How BareSQL knows	Read by
app.accounts.email table · text	email address high confidence	30 of 30 sampled values are email addresses	saas_admin_app, saas_agent, saas_app
app.accounts.full_name table · text	person's name medium confidence	the column name suggests person's name	saas_admin_app, saas_agent, saas_app
app.accounts.phone table · text	phone number high confidence	30 of 30 sampled values are phone numbers	saas_admin_app, saas_app
app.api_keys.api_key table · text	key, token or secret high confidence	3 of 3 sampled values look like random tokens; 3 of 3 sampled values contain a key or token	saas_admin_app
app.audit_log.actor_email table · text	email address high confidence	20 of 20 sampled values are email addresses	saas_migrator
support.ticket_context.email view · text	email address high confidence	comes from app.accounts.email	saas_agent
support.ticket_context.full_name view · text	person's name medium confidence	comes from app.accounts.full_name	saas_agent
support.ticket_context_invoker.email view · text	email address high confidence	comes from app.accounts.email	no audited login
support.ticket_context_invoker.full_name view · text	person's name medium confidence	comes from app.accounts.full_name	no audited login

Logins

bypassrls · member of no role · no password set

Personal data it can read	Holds	How
app.accounts.email table	email address	granted to saas_admin_app; all rows (BYPASSRLS)
app.accounts.full_name table	person's name	granted to saas_admin_app; all rows (BYPASSRLS)
app.accounts.phone table	phone number	granted to saas_admin_app; all rows (BYPASSRLS)
app.api_keys.api_key table	key, token or secret	granted to saas_admin_app; all rows (BYPASSRLS)

12 other columns it can read

Column	How
app.accounts.id	granted to saas_admin_app; all rows (BYPASSRLS)
app.accounts.tenant_id	granted to saas_admin_app; all rows (BYPASSRLS)
app.api_keys.id	granted to saas_admin_app; all rows (BYPASSRLS)
app.api_keys.tenant_id	granted to saas_admin_app; all rows (BYPASSRLS)
app.tenants.id	granted to saas_admin_app
app.tenants.name	granted to saas_admin_app
app.tickets.id	granted to saas_admin_app; all rows (BYPASSRLS)
app.tickets.tenant_id	granted to saas_admin_app; all rows (BYPASSRLS)
app.tickets.account_id	granted to saas_admin_app; all rows (BYPASSRLS)
app.tickets.subject	granted to saas_admin_app; all rows (BYPASSRLS)
app.tickets.body	granted to saas_admin_app; all rows (BYPASSRLS)
app.tickets.created_at	granted to saas_admin_app; all rows (BYPASSRLS)

member of saas_support · no password set

Personal data it can read	Holds	How
app.accounts.email table	email address	through view support.ticket_context (rights of saas_owner); all rows (owner; row security not forced)
app.accounts.full_name table	person's name	through view support.ticket_context (rights of saas_owner); all rows (owner; row security not forced)
support.ticket_context.email view	email address	granted to saas_support
support.ticket_context.full_name view	person's name	granted to saas_support

14 other columns it can read

Column	How
app.tickets.id	granted to saas_support; rows allowed by policy support_read through view support.ticket_context (rights of saas_owner); all rows (owner; row security not forced) through view support.ticket_list (rights of the reader); rows allowed by policy support_read through view support.ticket_overview (rights of saas_owner), then through view support.ticket_list (rights of the reader); rows allowed by policy support_read
app.tickets.tenant_id	granted to saas_support; rows allowed by policy support_read
app.tickets.account_id	granted to saas_support; rows allowed by policy support_read
app.tickets.subject	granted to saas_support; rows allowed by policy support_read through view support.ticket_context (rights of saas_owner); all rows (owner; row security not forced) through view support.ticket_list (rights of the reader); rows allowed by policy support_read through view support.ticket_overview (rights of saas_owner), then through view support.ticket_list (rights of the reader); rows allowed by policy support_read
app.tickets.body	granted to saas_support; rows allowed by policy support_read
app.tickets.created_at	granted to saas_support; rows allowed by policy support_read
support.invoice_summary.id	granted to saas_support
support.invoice_summary.amount	granted to saas_support
support.ticket_context.id	granted to saas_support
support.ticket_context.subject	granted to saas_support
support.ticket_list.id	granted to saas_support
support.ticket_list.subject	granted to saas_support
support.ticket_overview.id	granted to saas_support
support.ticket_overview.subject	granted to saas_support

6 columns it may select that give it nothing today

Column	How
app.invoices.id	through view support.invoice_summary (rights of saas_owner); no rows (row security on, no policy lets this role read)
app.invoices.amount	through view support.invoice_summary (rights of saas_owner); no rows (row security on, no policy lets this role read)
support.ticket_context_invoker.id	granted to saas_support; reading it fails: the view needs app.accounts.email, app.accounts.full_name and app.accounts.id, which the reader may not read
support.ticket_context_invoker.subject	granted to saas_support; reading it fails: the view needs app.accounts.email, app.accounts.full_name and app.accounts.id, which the reader may not read
support.ticket_context_invoker.email email address	granted to saas_support; reading it fails: the view needs app.accounts.email, app.accounts.full_name and app.accounts.id, which the reader may not read
support.ticket_context_invoker.full_name person's name	granted to saas_support; reading it fails: the view needs app.accounts.email, app.accounts.full_name and app.accounts.id, which the reader may not read

member of no role · no password set

Personal data it can read	Holds	How
app.accounts.email table	email address	granted to saas_app; rows allowed by policy tenant_isolation
app.accounts.full_name table	person's name	granted to saas_app; rows allowed by policy tenant_isolation
app.accounts.phone table	phone number	granted to saas_app; rows allowed by policy tenant_isolation

10 other columns it can read

Column	How
app.accounts.id	granted to saas_app; rows allowed by policy tenant_isolation
app.accounts.tenant_id	granted to saas_app; rows allowed by policy tenant_isolation
app.tenants.id	granted to saas_app
app.tenants.name	granted to saas_app
app.tickets.id	granted to saas_app; rows allowed by policy tenant_isolation
app.tickets.tenant_id	granted to saas_app; rows allowed by policy tenant_isolation
app.tickets.account_id	granted to saas_app; rows allowed by policy tenant_isolation
app.tickets.subject	granted to saas_app; rows allowed by policy tenant_isolation
app.tickets.body	granted to saas_app; rows allowed by policy tenant_isolation
app.tickets.created_at	granted to saas_app; rows allowed by policy tenant_isolation

What it can change (6)

Table	Privilege	How
app.accounts personal data	INSERT	granted to saas_app; rows allowed by policy tenant_isolation
app.accounts personal data	UPDATE	granted to saas_app; rows allowed by policy tenant_isolation
app.accounts personal data	DELETE	granted to saas_app; rows allowed by policy tenant_isolation
app.tickets	INSERT	granted to saas_app; rows allowed by policy tenant_isolation
app.tickets	UPDATE	granted to saas_app; rows allowed by policy tenant_isolation
app.tickets	DELETE	granted to saas_app; rows allowed by policy tenant_isolation

member of no role · no password set

Personal data it can read	Holds	How
app.audit_log.actor_email table	email address	owner saas_migrator; all rows (owner; row security not forced)

3 other columns it can read

Column	How
app.audit_log.id	owner saas_migrator; all rows (owner; row security not forced)
app.audit_log.tenant_id	owner saas_migrator; all rows (owner; row security not forced)
app.audit_log.action	owner saas_migrator; all rows (owner; row security not forced)

What it can change (4)

Table	Privilege	How
app.audit_log personal data	INSERT	owner saas_migrator; all rows (owner; row security not forced)
app.audit_log personal data	UPDATE	owner saas_migrator; all rows (owner; row security not forced)
app.audit_log personal data	DELETE	owner saas_migrator; all rows (owner; row security not forced)
app.audit_log personal data	TRUNCATE	owner saas_migrator

Everyone (PUBLIC)

What every role can read, including roles created after this audit.

No personal data is open to every role.

Method

Schemas audited: app, public, support. Connection: postgres://[email protected]:5432/baresql_fx_saas, login method md5.

BareSQL never calls a function written in SQL or a procedural language, never reads views or foreign tables, and never writes. Sampled values are turned into text by their type's own output function, never by a cast, and each table is read on its own, without its partitions or child tables. Views are traced to the columns they read from their stored definitions, without running them.

Every fact in this report is also in audit.json, which baresql diff and baresql audit --baseline compare with a later audit.

Access audit of baresql_fx_saas

Findings

Who can read personal data

Personal data in this database

Logins

saas_admin_app

saas_agent

saas_app

saas_migrator

Everyone (PUBLIC)

Method