From community review to a shipped security hardening with Codex

Описание и применение

Пользовательский цикл от обзора сообщества к выпуску обновления безопасности с помощью Codex, улучшивший модель авторизации и тестируемость в пакете Tenant Evidence Kit.

Задача

How to attach evidence to business objects without leaking tenant data or duplicating authorization logic.

Результат

The iterative review‑implementation loop using Codex turned a community security review into a shipped, upgrade‑safe hardening of the Tenant Evidence Kit, improving authorization clarity and test coverage.

Рабочий процесс

• Share project with Supabase community
• Receive detailed security review
• Create scoped issue with explicit acceptance criteria
• Use Codex to implement changes
• Human review and correction
• Run CI tests
• Release updated version

Доказательства

The feedback raised several important questions: roles existed, but authorization was still too close to flat membership; evidence deletion needed a more explicit privilege boundary; the lack of UPDATE support needed to be intentional rather than accidental; RLS assumptions around service_role, table owners and BYPASSRLS needed to be documented; authorization needed behavioral tests, not only static SQL assertions.

Источник

The workflow became: community review → scoped issue → Codex implementation → human review → correction pass → CI → release

Источник