Multi-Tenant Safety Check

Apply when writing any database query in routes/, lib/services/, or workers/.

This platform serves 40+ tenants. One data leak destroys trust across all of them.

Before writing ANY query:

1. •Does this query filter by tenant_id in EVERY WHERE clause?
2. •If it joins tables, does EACH table in the join have tenant_id filtering?
3. •Could a NULL tenant_id cause this to return data from all tenants?
4. •If this uses RLS (set_config), does it have a fallback if set_config fails?
5. •Is the tenant_id sourced from req.tenantContext (trusted) or from req.body (untrusted)?

Every query must use: .where({ tenant_id: tenantId }) or .where('tenant_id', tenantId) Phone numbers must be E.164 format. Normalize with normalizePhoneE164() before querying.