Security definer

A security definer function runs as whoever created it, not whoever calls it. That is useful and sometimes necessary: a function can check a role without the caller needing permission to read the roles table, which avoids rules that reference themselves in a loop.

It is also a hole with a handle on it. Any function marked this way is a path around your row rules, and if it takes an argument that decides which rows it returns, the caller now chooses what to read with the author's permissions.

The safe pattern is narrow: no arguments that select rows, a fixed search path, and execute permission granted only to the roles that need it. It is invisible from outside, so it belongs to code review.

No incident in the library maps to this one yet.