Serverless Task Board Blocks 27 Security Attacks Using Postgres Row-Level Security

Developers built a multi-tenant task board with no backend server, relying entirely on static files, Neon Auth for authentication, and the Neon Data API backed by PostgreSQL for authorization. Security was enforced through row-level security policies, column grants, and a single Postgres function, with tenant isolation derived from a signed JWT containing the user's organization ID. A simulated attacker with a valid account attempted 27 distinct intrusion methods — including forged tokens, crafted filters, bulk updates, and algorithm-substitution attacks — all of which were blocked. Deliberate security misconfigurations were then introduced one at a time, and three of the four allowed specific attacks through, while a fourth was neutralized by a secondary layer. The one limitation identified was a roughly 15-minute window during which a removed team member could still access data using their existing token, a flaw the team noted has a known fix.