Checks · DB-010

DB-010 · security definer function without search_path

Why it matters

A definer function with a loose search path can be tricked into running a different function than the one you wrote.

How we detect it

SQL functions marked security definer without a fixed search_path.

How we fix it

Set search_path to empty on the function and schema-qualify every call.

Can it be fixed automatically? Yes, with a template change

Related checks

• SEC-001 · Secret committed in repo (current tree)
• SEC-002 · Secret in git history
• SEC-003 · Service-role or secret key in client bundle
• SEC-004 · Public env prefix on a secret