SET leaks tenant context across a pooled connection

A session-scoped SET for tenant identity survives past the request that set it under transaction-mode pooling, leaking one request's org into the next.

This is one of the things Multi-Tenant Auth & RBAC Core already handles. Sign-in, organisations, invites and roles — with one customer's data provably unable to reach another's.

Buy for $1492 of 3 clean-room builds passed · full refund if it fails on your machine

Is this you?

Setting the current tenant with a plain SET app.org_id = '...' persists for the lifetime of the underlying Postgres connection, not the logical request. Under transaction-mode connection pooling (PgBouncer, Neon's pooler) -- the standard way to serve more concurrent requests than raw Postgres connections allow -- the next request that happens to reuse that same pooled connection inherits the previous request's tenant context, invisibly, until concurrent production traffic exposes it.

Why this one is easy to get wrong

SET is the first thing that comes up when searching how to pass a value into an RLS policy, it works perfectly in local development against a direct, unpooled connection, and the bug requires two things to line up (transaction-mode pooling and a specific interleaving of requests) that a local dev environment or a single-connection test almost never reproduces.

What you get instead

Core decision 3 wraps every tenant-scoped query in withContext() (a frozen helper in src/lib/db.ts), which sets identity with set_config('app.user_id'|'app.org_id', $x, true) -- the third argument, is_local=true, means the setting dies at COMMIT or ROLLBACK, not at connection close. That's what makes it safe under transaction-mode pooling: nothing outlives the transaction it was set inside.

Source: ARCHITECTURE.md core decision 3, 'Traps this pack pre-empts' — checkable in the pack you receive

How you actually use this

You don’t install a library or wire up an SDK. Your own coding agent builds the code in your project, and you keep it — no runtime dependency on us.

Step 1
Download and unzip
You get a folder: the docs that tell an agent what to build, a starting skeleton, and the test suite that decides when it's done.
Step 2
Open it in Claude Code or Cursor
Point your coding agent at the folder. Nothing to install, no account with us, no API key.
Step 3
Paste one prompt
The pack contains the exact prompt. Paste it as your first message and leave it alone — it works through the build itself, choosing a cheaper or stronger model per task.
Step 4
Run ./verify.sh
One command. It prints a pass or fail for every check. Green means the build is done — the same script we ran to produce the receipt on this page.

Typical build: about 12 minutes of your agent working, mostly unattended. Then you integrate the working module into your app the way you would any code you’d written yourself.

Why you can believe this

2 of 3 runs passed

We ran this pack from an empty folder 3 times and published exactly what happened — every check, the model, the token cost, the wall time. Not a testimonial, and not our opinion: the same verify.sh you run yourself. Read the full receipt →

Buy for $149 14-day refund if verify.sh fails →