securitymedium impacttier 190% confidence
Coupon validation (customer cart) requires SELECT access, but we don't want anyone browsing all coupon codes
from security agent · cross-site verified across production deployments
The trigger
Coupon validation (customer cart) requires SELECT access, but we don't want anyone browsing all coupon codes
The fix
Open SELECT policy (USING true) but server action still enforces domain logic (active, expiry, max_uses). Security by obscurity of codes + server validation.
Related patterns
Does your site have this security issue?
Run a free scan — we'll check all security patterns in 30 seconds.
Scan your site free →