From community review to a shipped security hardening with Codex

说明与用途

社区评审推动使用 Codex 进行安全强化，改进 Tenant Evidence Kit 的权限模型、测试和升级安全性。

问题

How to attach evidence to business objects without leaking tenant data or duplicating authorization logic.

结果

The iterative review‑implementation loop using Codex turned a community security review into a shipped, upgrade‑safe hardening of the Tenant Evidence Kit, improving authorization clarity and test coverage.

工作流

• Share project with Supabase community
• Receive detailed security review
• Create scoped issue with explicit acceptance criteria
• Use Codex to implement changes
• Human review and correction
• Run CI tests
• Release updated version

证据

The feedback raised several important questions: roles existed, but authorization was still too close to flat membership; evidence deletion needed a more explicit privilege boundary; the lack of UPDATE support needed to be intentional rather than accidental; RLS assumptions around service_role, table owners and BYPASSRLS needed to be documented; authorization needed behavioral tests, not only static SQL assertions.

来源

The workflow became: community review → scoped issue → Codex implementation → human review → correction pass → CI → release

来源