023_security_hardening.sql:
- Item 1 (CRITICAL, advisor lint 0010): founder_pricing_seats view → recreate
with security_invoker=on so it respects RLS instead of running as definer.
(The founder counter no longer depends on it — item 0 uses Stripe directly.)
- Item 3: waitlist write hole — drop the always-true policies, anon may INSERT
only, update/delete/read via service role.
- Item 5: pin an explicit search_path on the flagged functions (lint 0011).
024_anon_revoke_discoverability.sql:
- Item 4: revoke anon SELECT on the advisor-named tables (accuracy_tracking,
bets, cascade_alerts, closing_lines, coach_profiles, daily_scan) + a
commented broad sweep. The frontend reads data via Express (service role),
never as anon, so this is safe. REVOKE/KEEP rationale documented in the file.
These need Kev to apply (no DB access from here); fingerprint = re-run the
Security Advisor and confirm the lints clear.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
builtbykev
78c19291c9