RLS & tenancy gaps
Row-Level Security enforces membership but leaves several holes a rebuild must close.
case-attachments has no tenant isolation
The private case-attachments bucket holds all confidential material: case evidence,
Self-provisioning privilege escalation
Two permissive RLS policies combine into an escalation path:
Hardcoded credentials & committed secrets
Several credential-handling issues, each a must-fix:
HTML injection in the dossier
generate-dossier builds dossier.html by string concatenation with only partial
Portal has no rate limiting
The external portal (portal-access) authorizes solely on an opaque token
Legacy plaintext access_password
cases.access_password TEXT NOT NULL is a survivor of the whistleblower-template ancestry