Level 2
The function is the hole
The scenario
The bookings table is locked down — each customer can only see their own bookings.
But a backend function that lists bookings never checks who is calling it, and returns every booking anyway.
Guided hint · Beginner mode
The table itself is safe now. Ask: what else reads this data? Run Dashboard → Security → Run Security Scan and see whether the scan has already spotted the open door.