[P3] Bug bounty — Huntr ou GitHub Security

[SebastienGosa]

Scope : auth, RLS, XSS, CSRF. Rewards €50-500. Hall of Fame security.

[legalverb]

Submitted PR #188 for the security/RLS bounty scope: #188

Summary:

• Direct users table reads were effectively public because the RLS SELECT policy included OR true, while the table contains email, reader preferences, location, reading stats, supporter flags, timestamps, and other account metadata.
• The PR changes direct users reads to owner-only and adds a public_user_profiles view for safe public profile rendering.
• It also splits public read policies from owner-only write/delete policies for reading lists and annotations so public rows are not eligible for mutation if grants are present.

Validation notes are in the PR. I kept the change scoped to database/schema.sql.

[optimystical]

Submitted PR #190 for the RLS bounty scope: #190

Summary:

• Enables RLS on analytics/tracking/audit tables: search_queries, affiliate_clicks, and system_jobs.
• These tables may contain user-linked search text, IP/user-agent tracking metadata, conversion/order identifiers, worker parameters, and job errors.
• No direct anon/authenticated policies are added, so server routes, cron jobs, and workers should use service_role for these internal tables.

Validation: git diff --check.

[zaixincheng174-ai]

Submitted PR #191 for the RLS/security bounty scope: #191

Summary:

• collections contains curator-owned draft fields and organization-scoped B2B metadata (curator_user_id, is_published, organization_id), but RLS was not enabled.
• collection_books can expose the contents and notes of those collections.
• The PR enables RLS for both tables, limits direct public reads to published public-catalog collections, and gates writes through curator ownership.

Validation: git diff --check; runtime schema apply not run locally because this environment has no docker or psql.

/claim #100

[zaixincheng174-ai]

Submitted a second non-overlapping PR for the RLS/security bounty scope: #192

Summary:

• authors.organization_id and books.organization_id are documented for future B2B tenant rows (NULL = public catalog), but the catalog tables and public catalog view did not enforce that boundary.
• The PR enables RLS on the catalog tables and limits direct client reads to public-catalog books/authors and their derived translations/files/ISBN/category links.
• It also makes the catalog views security-invoker and filters the catalog dashboard to public-catalog rows so tenant-scoped rows are not exposed through views.

Validation: git diff --check; runtime schema apply not run locally because this environment has no docker or psql.

/claim #100

[zaixincheng174-ai]

Submitted a third non-overlapping PR for the RLS/security bounty scope: #193

Summary:

• affiliate_retailers contains partner tags, commission rates, inactive routing config, and operator notes, but direct public API access was not guarded by RLS.
• The PR enables RLS for affiliate_retailers and intentionally adds no anon/auth policy, keeping direct table access closed while trusted server/service-role code can still manage affiliate URL generation.
• It also marks v_affiliate_performance as security_invoker so the revenue/performance dashboard view respects caller RLS instead of bypassing table protections by default.

Validation: git diff --check; pnpm --filter @librarfree/db typecheck could not run because this checkout has no node_modules/tsc; runtime schema apply not run locally because this environment has no psql or docker.

/claim #100