How PostgreSQL Row-Level Security Stops Cross-Tenant Data Leaks at the Database

·4 views

B2B startups commonly use a shared PostgreSQL database with a tenant_id column to separate customer data, but relying on application code to enforce this boundary creates serious risk. A single missed filter in one query can expose one customer's data to another, triggering legal obligations and derailing enterprise deals rather than a simple bug fix. PostgreSQL has supported Row-Level Security (RLS) since version 9.5 in 2016, which moves the data isolation guarantee from developer memory into the database engine itself. The article outlines three multi-tenancy models — shared schema, schema-per-tenant, and database-per-tenant — each with different cost and isolation trade-offs. It also warns of specific pitfalls, including connection pooler configurations that can silently disable RLS in production environments.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

AI Coding Assistants Speed Up Development but Risk Silent Codebase Drift

AI autocomplete tools promise faster coding by reducing keystrokes and boilerplate, but their suggestions are based on generic patterns rather than a team's specific architecture or conventions. A common problem emerges when accepted suggestions introduce locally correct but globally redundant code, such as duplicate logic that no one intended to create. Because no single autocompleted line obviously breaks anything, the cumulative drift goes unnoticed until review or debugging stages, often costing more time than writing deliberate code would have. Developers who accept suggestions uncritically are effectively deferring judgment to code review or production debugging rather than eliminating effort. Teams can mitigate this by choosing between always-on autocomplete with strong rejection instincts, on-demand AI for specific tasks, or limiting AI to research and planning to keep architectural decisions firmly in human hands.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer Reverses Testing Order, Puts Mobile First to Catch Layout Flaws Early

A developer at RAXXO studio changed their workflow to test every tool on a smartphone before opening it on a desktop browser. The old desktop-first habit had masked recurring layout and tap-target issues for months, since large screens absorb small design mistakes that narrow screens expose. Multiple user complaints about cramped layouts and hard-to-tap buttons were being patched individually, until a pattern emerged linking nearly all of them to insufficient mobile testing. Reversing the testing order — phone first, desktop second — forced design decisions to account for limited space from the start, changing what gets built rather than just what gets reviewed afterward. The developer notes the rule applies even to developer-focused tools, since landing pages and first impressions are still experienced on mobile.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Polymarket and Kalshi Settle BTC Contracts Differently — and It Matters for Trading Bots

Both Polymarket and Kalshi now settle short-duration Bitcoin binary contracts using a 60-second average price rather than a single last-print snapshot, but the two platforms use different indexes and sampling methods. Polymarket relies on a Chainlink-computed time-weighted average price (TWAP) that can be tracked live throughout the contract slot, while Kalshi uses a simple average of the CF Benchmarks real-time index over the final minute before expiry. The shift away from snapshot settlement on both platforms was driven by documented manipulation, where brief price pushes at contract close created unfair outcomes for retail participants. Because the settlement mechanics differ, a trading bot trained on Polymarket's TWAP signal cannot be directly applied to Kalshi without recalibration — the underlying price references are not equivalent. Developers building automated strategies must first identify the exact settlement number each venue uses before constructing signals, backtests, or execution logic.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Indian Startups Turn to AI Agents to Automate GST and Tax Compliance

Indian startups have long relied on spreadsheets to manage compliance tasks such as GST returns, TDS reconciliation, and ROC filings. A growing shift is now underway, with companies deploying AI agents to automate these processes. These systems use Python scripts and GSTN sandbox APIs to pull GSTR-2B data nightly and handle section classification. The trend is particularly notable among SMEs and early-stage startups seeking to reduce manual accounting workloads. Observers say AI-driven tax compliance tools could significantly reshape how small businesses manage regulatory obligations in India.

0 comments Read more at DEV Community