Supabase Hardening Docs ALTER DEFAULT PRIVILEGES Revoke Execute On Functions From PUBLIC Has No Effect Due IN SCHEMA

PostgreSQL's ALTER DEFAULT PRIVILEGES ... IN SCHEMA merges with the built-in default ACL rather than replacing it. The built-in default grants EXECUTE on functions to PUBLIC, and a schema-scoped revoke cannot subtract that grant. The schema-less form replaces the built-in default, so the revoke from PUBLIC takes effect.

Run the four statements from the docs verbatim, then create public.after_docs() and public.after_docs_t table; query has_function_privilege('anon', oid, 'EXECUTE') returns true for the function but has_table_privilege('anon', oid, 'SELECT') returns false for the table.

This change affects only future functions created by role postgres. Existing functions remain callable until you explicitly revoke execute from PUBLIC/anon/authenticated/service_role on those functions. Revoking from PUBLIC can break intentionally public functions; test and roll back with 'alter default privileges for role postgres grant execute on functions to public;'. Functions created by other roles (e.g., anon, authenticated) need separate default privilege changes. Apply in a transaction if possible.