Tatabbu

01Why this one is hard

A family-safety app holds the single most dangerous field in consumer software: a child’s live location. Every other feature is ordinary; that one field turns a bug into a physical risk.

The usual failure is not a dramatic breach. It is an ordinary query that forgot a filter, in a codebase where the security decision lives in the application layer and is repeated in forty places.

13

02The constraint I set

Authorization does not live in the app. It lives in the database, as row-level security (RLS) policies, so a forgotten filter in client code cannot widen access — the database simply returns nothing.

Data residency was chosen deliberately: Supabase in the EU (Frankfurt), under a regime with a real answer to who can compel disclosure.

03Decisions

Every table denies by default. Access is granted by explicit policy, per row, per role. There is no 'authenticated users can read' shortcut anywhere.

The client is treated as hostile. Nothing the app sends is trusted to identify who is asking; identity is taken from the verified session on the server side.

Store declarations were written before the features. Foreground-service type and background-location justification were designed into the build, which is why review was not a negotiation.

04How it was verified

Inspection is not evidence. I wrote 25 SQL-level privilege probes that attempt, as each role, exactly the reads and writes that must fail — and assert that they do.

Then I attacked my own policies: 34 mutations deliberately weakened the security rules one at a time, and the probe suite had to catch every one. A policy layer that survives mutation is a policy layer that is actually load-bearing.

This method found real gaps that reading the policies had not. Two are worth naming, because both are invisible to inspection: a function still reachable through Postgres’ default PUBLIC grant after being revoked from the app role — the function from the top of this page; and a guard comparing a JSON extraction with <>, which yields NULL rather than false when the key is absent — a check that silently passes everything.

05Outcome

Cleared Google Play review in 14 minutes, including the two declaration classes that most often stall a release.

Opened to closed testing in 176 countries with a complete data-safety disclosure and a Parenting category listing.

06What I would change — and what it still costs

The probe suite grew after the policies, not with them. Written first, it would have caught both defects before they ever reached a migration.

Residency in Frankfurt is right for privacy and wrong for latency from the Gulf. That is a trade I made on purpose and would make again — but it is a trade, not a free win.