A script that walks the API and library source, finds every direct query against an account-scoped table, and flags any whose statement and near context never mention org_id. Known pre-existing hits live in a baseline file so the check fails only on NEW violations; the baseline is meant to be burned down, never added to without review.
Also called: tenant isolation test · CI check · forgot the org filter · scoping baseline
- 1Every .ts/.tsx file under the API and library directories is scanned.
- 2A query against an account-scoped table is flagged if neither its chain (up to the terminating semicolon) nor the five lines above it mention org_id.
- 3The central data proxy is excluded because it enforces scoping itself.
- 4Results are compared against scripts/org-scoping-baseline.json; only new entries fail.
- 5Flags support printing everything or regenerating the baseline deliberately.
The header states the reason bluntly: 'tenant isolation is app-enforced only (RLS policies are allow-all and the service key bypasses them regardless). The generic /api/db proxy stamps org_id centrally, but ~40 dedicated routes + server libs hand-write .from("table")… chains. One forgotten .eq("org_id", …) is a silent cross-tenant read/write with no DB backstop. This script is the tripwire.' It is explicitly described as a heuristic, not a proof — which is also why the audit-log helper keeps its org_id adjacent to the insert: 'burying org_id 20 lines down reads to it (correctly, in general) as an unscoped write.'
- A single forgotten filter in a new endpoint is invisible in review and has no database-level backstop.
- Existing known gaps would otherwise make a strict check unusable on day one.
See it on your own jobs
Twenty minutes, your numbers, no slide deck. We’ll build one of your real buildings in front of you and send you the estimate link at the end — yours to keep either way.
or keep browsing features →