Level 7Level-up pack
Signed in is not allowed in
The scenario
PetPals' bookings table is locked: each customer can only read their own bookings.
But an “Export my bookings” backend function checks that the caller is signed in, then reads the table as the service role, which skips the table's rules. Any customer who calls it gets everyone's bookings.
Guided hint · Beginner mode
Open the backend function and find where it reads the data. If it reads as the service role, the table's Read rule is not applied. Then check whether the function itself limits what the caller can see.