[Security] QC-15: Extensive SECURITY DEFINER usage in Supabase functions

[kai-agent-free]

Severity: ℹ️ INFO

Affected files: Multiple SQL migration files

Description

Many Supabase/PostgreSQL functions use SECURITY DEFINER, which causes them to execute with the privileges of the function owner rather than the calling user. While not necessarily a bug, extensive use increases the attack surface.

Impact

If any SECURITY DEFINER function has a vulnerability (e.g., SQL injection), it could be exploited with elevated privileges.

Recommendation

Review all SECURITY DEFINER functions and apply the principle of least privilege:

• Switch to SECURITY INVOKER where possible
• For functions that must use SECURITY DEFINER, ensure they have explicit search_path and thorough input validation