Open by default
A table ships without row level security enabled. The application never queries it incorrectly, so nothing breaks and nobody notices. Anyone with the public key can read every row directly, and no log records that they did.
Pillar 04 · Cyber
Hiding the button
is not security.
Most access control lives in the interface. Remove the interface and the data is still there — readable by anyone holding a public key. We test that directly, and the only acceptable result is nothing.
-- authenticated as tenant_a
SELECT * FROM patients
WHERE tenant_id = 'tenant_b';
(0 rows)
RLS policy: deny by default · CYB-02 PASS
Verified by query, never by interface. Any returned row is a Critical finding.
Quick answer
What is Row Level Security, and why does it matter?
Row Level Security is a database feature that controls which rows a given user can read or modify, enforced by the database engine itself rather than by application code or the user interface. It matters because modern applications expose the database directly to the browser through a public API key, so any control existing only in the interface can be bypassed by calling the API directly — a hidden button is a visual choice, not a permission. Correct implementation requires row level security enabled on every table holding user or tenant data, with an explicit default-deny policy, and verification performed by querying one tenant's data while authenticated as another. Zero rows returned is the only passing result.
The problem
The most common failure
is the one nobody audits.
Vulnerability scanners check dependencies. Penetration tests probe the perimeter. Almost nobody opens the database and reads the policies — which is precisely where the data is.
Enabled but never verified
Policies exist and look plausible in the dashboard. Nobody has run a cross-tenant query to confirm they hold. A policy that has never been tested is a belief, not a control.
Secrets in the bundle
A service key ends up in the client bundle or in repository history. It is publicly readable, it grants full access regardless of every policy above it, and rotating it after discovery does not undo what was already taken.
Four services
Cyber, in four parts.
Assessment depth is legally constrained, so scope is enforced by the engagement rather than assumed. Passive checks need no permission; anything deeper requires verified ownership.
01
02
03
04
Security Audit & Hardening
External assessment of security headers, transport configuration, DNS records, exposed files, leaked secrets and known vulnerabilities — followed by a prioritised hardening engagement rather than a report you are left to interpret.
Explore security auditDatabase & RLS Security Review
Deep review of row level security policies, roles, storage permissions and access paths, verified by direct query rather than by inspection. The most common failure in modern applications, and the one almost nobody offers to test.
Explore database securityAI & Agent Governance
Readiness assessment against NIST AI RMF and ISO 42001 — approval thresholds, override capability, audit logging, capability bounds and data residency for organisations deploying autonomous agents.
Explore AI governanceManaged Security & Monitoring
Continuous monitoring, dependency patching on a defined cadence, and incident response with a named contact — so exposure is caught while it is still a finding rather than an event.
Explore managed securityScope & authorisation
What we may test, and when.
Active probing of systems you do not own is unlawful in every jurisdiction we operate in, including under Pakistan's PECA 2016. These tiers are enforced by the engagement, not by a terms-of-service page.
Tier 0
No authorisation required. Rate-limited, robots.txt respected.
Passive external
Reads only what a server voluntarily returns to any visitor. Headers, transport, DNS, publicly reachable paths.
Tier 1
Verified domain ownership plus read-only credentials granted by the owner.
Authenticated review
Configuration review of database policies, roles, storage permissions, CI and infrastructure settings.
Tier 2
Signed scope agreement defining targets, address ranges, test window and named contact.
Active testing
Injection, authentication bypass and access-control probing against a live system.
Tier 3
Written engagement. Delivered by people, not tooling.
Manual assessment
Threat modelling, business logic review, red team exercises.
Every assessment is logged and retained in full. Security findings are private by default and are never published without written consent.
Key facts
Where the Standard is strictest.
19Cyber rules in the Qawex Standard, more than any other pillar
9Classified Critical — nearly half, because these failures are the least recoverable
0Rows a cross-tenant query may return. Any other number is a Critical finding
Why Cyber carries the most Critical rules. A performance regression is corrected and forgotten; a data disclosure is permanent. Once records have been read by someone who should not have read them, no subsequent fix returns the system to its prior state — which is why the Standard weights this pillar most heavily and why nine of its nineteen rules block certification outright. The severity reflects recoverability, not difficulty. Several of these rules take minutes to satisfy at build time and are effectively impossible to satisfy afterwards.
Source: The Qawex Standard v1.0, rules CYB-01 to CYB-09 · Read the Cyber rulesRow level security enabled on every table holding user or tenant data, with an explicit default-deny policy.
Access policies verified by direct query. Cross-tenant access returns zero rows.
No credentials, API keys or tokens in client bundles, repositories, or version history.
Object storage private by default. Public access explicit, justified and scoped.
Questions
Answers, not brochures.
Can you test our system without permission?
Only at Tier 0 — passive external observation of a public site, which reads nothing a normal visitor could not see. Anything requiring credentials or active probing needs verified domain ownership, and active testing needs a signed scope agreement with defined targets and a test window. Probing systems you do not own is unlawful, including under Pakistan's PECA 2016, and we build the gate into the engagement rather than into a disclaimer.
We already had a penetration test. Do we need this?
Possibly not, but check what it covered. Traditional penetration testing focuses on the perimeter, the application surface and known vulnerability classes. It rarely opens the database and reads the access policies, because that requires credentials and a different skill set. If your report does not contain the result of a cross-tenant query, that surface was not examined.
What happens if you find something serious?
You are told immediately, privately, and before anything is written into a report. Critical findings are communicated the same day with the remediation path attached. Security findings are never published, never used in marketing and never shared without written consent — that constraint holds regardless of whether you become a client.
Do you fix what you find, or just report it?
Both are available and they are priced separately, deliberately. The audit is useful on its own, and you may take the findings to your own team or another firm. Where you want us to remediate, hardening is a distinct engagement so the assessment stays honest rather than becoming a sales instrument.
Is our data safe during the review?
Read-only credentials are used wherever access is required, scoped to the minimum needed and revoked at the end of the engagement. We do not copy production data. Where a data sample is genuinely necessary for analysis, it is agreed in writing beforehand and handled under the residency terms in the engagement.
What is AI and agent governance, and do we need it yet?
It is a readiness assessment against NIST AI RMF and ISO 42001 covering approval thresholds, override capability, audit logging, capability bounds and data residency for autonomous systems. You need it when someone asks you to evidence it — increasingly a procurement requirement for enterprise and public-sector buyers, and materially easier to satisfy before agents are deployed than afterwards.
Find out what is actually exposed.
The Tier 0 assessment runs against any public URL and reports headers, transport, DNS, exposed files and leaked secrets. Free, and yours whether or not you work with us.