fix: block client INSERT/DELETE on leaderboard to prevent score forgery (#1925)

[atul-upadhyay-7]

Fixes #1925

Problem

The consolidated RLS policies let any authenticated user INSERT their own leaderboard row with arbitrary xp/streak/sessions_joined/badges values and DELETE it (to re-insert with fabricated scores). Prior hardening only restricted UPDATE, so score forgery was still possible:

delete from public.leaderboard where user_id = auth.uid();
insert into public.leaderboard (user_id, username, xp, streak, sessions_joined, badges)
values (auth.uid(), 'x', 2147483647, 9999, 999, '{top}');

Changes

New migration 20260805000002_block_leaderboard_client_insert_delete.sql:

• Drop "Users can insert leaderboard entry" and "Users can delete leaderboard entry" policies.
• REVOKE INSERT, DELETE ON public.leaderboard FROM anon, authenticated;
• Document the updated security model on the table.

The SECURITY DEFINER join_leaderboard() RPC (zero-initializes scores, used by Leaderboard.tsx) remains the only legitimate row-creation path and is unaffected by the revoke.

Verification

• Confirmed the frontend only creates leaderboard rows via rpc("join_leaderboard").
• Confirmed the only other leaderboard INSERT in migrations lives inside the SECURITY DEFINER RPC (20260529000001 / 20260601000009), which bypasses RLS/grants as the owner.

[vercel]

@atul-upadhyay-7 is attempting to deploy a commit to the durdana3105's projects Team on Vercel.

A member of the Team first needs to authorize it.

[coderabbitai]

Warning

Review limit reached

@atul-upadhyay-7, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 58 minutes

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 37b4332e-298d-46ff-a3e6-41dd65cc2cb1

📥 Commits

Reviewing files that changed from the base of the PR and between 880eed9 and 49849c8.

📒 Files selected for processing (1)

• supabase/migrations/20260805000002_block_leaderboard_client_insert_delete.sql

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}