Project sign-in settings

Check method

With a read-only key: open signup, email confirmation, password strength, token lifetime and rotation, and edge functions callable without a token.

Possible evidence type

Code or configuration review, without exploiting the risk.

Access and limitations

Connected repository. Actual results and checks not run appear in your report. A check with no finding does not guarantee the absence of risk.

Concrete scenario

Source defaults and hosted sign-up or recovery settings do not match.

What to inspect

Review the deployed provider settings through an authorized read; source code alone cannot establish the hosted configuration.

Remediation approach

Align required account protections in the provider and application, then validate the authorized account lifecycle.

Understand grants, policies and identity

Database grants determine whether a role can reach a table or function; row-level security determines which rows it can access. Enabling RLS without a usable policy can block legitimate users, while a broad policy can expose every tenant. A privileged server credential may bypass these protections and must never be shipped to the browser.

1. Identify the role making the request and the identity used by the policy.
2. Review both table grants and policies for each read or write operation.
3. Check owner access to private, draft and archived rows separately from public access.

Validate without changing production data

Catalog-only inspection can show policy definitions and privilege configuration, but does not prove every application-level access path. Two-account isolation exercises provide stronger behavioral evidence when separately authorized. Backup availability is also different from a successful restore test.

1. Review definitions and grants in the supported read-only audit.
2. Use isolated test records for any owner-approved behavioral exercise.
3. Retest the expected owner access and denied cross-account access after changes.

References

OWASP A07