Any signed-in user can read every other user's orders.
- What it means
- Anyone who makes a free account can see your customers' names, addresses and order history.
- The story
- As a customer, I can only ever see my own orders.
- Tasks
-
- Turn on row level security for the orders table.
- Add a policy that returns only the signed-in user's rows.
- Write a test that proves user A cannot read user B's orders.
- Check every screen that lists orders still loads.
Illustrative sample, not from a client's app.