Inference protection

Masking hides output. Policy must hide clues.

A caller can reconstruct a secret without selecting it by asking whether guesses match, sorting by it, or measuring ranges and aggregates. Safe Boundary recognizes these operations on protected PostgREST fields.

Get early access
Review the security model →

Why this exists

Close the query-oracle side channel

For each protected field, policy chooses whether inference-sensitive operations are blocked, equality-style checks are allowed, or the finding is observed only. The analyzer covers direct fields and supported embedded-resource paths.

This is separate from response masking. The response transformer protects values that come back; the inference guard protects information encoded in which rows, order, counts, and aggregates come back.

What it does

Concrete controls, stated precisely.

01

Operator-aware

Pattern search, ranges, ordering, full-text search, and aggregation can be denied on protected fields.

02

Equality-only mode

Policy can retain eq, in, and is checks while closing higher-bandwidth inference operations.

03

Nested path coverage

Supported filters on embedded PostgREST resources resolve to the protected underlying column.

How it works

A visible enforcement sequence.

  1. 1

    Protect

    Mark a column with a masking rule.

  2. 2

    Inspect

    Parse filters, ordering, search, and aggregates before proxying.

  3. 3

    Decide

    Apply block, equality-only, or observe behavior.

  4. 4

    Mask

    Transform any allowed protected values in the response.

Protected when

  • ✓Configured masked columns on the PostgREST path
  • ✓Direct and supported embedded-resource filters
  • ✓High-signal operators that can reveal protected values

Important boundaries

  • —Only routed PostgREST requests are inspected
  • —Equality checks may still disclose membership and must match your threat model
  • —This does not cover Realtime, GraphQL, Storage, or arbitrary application endpoints

Continue the story

Related Safe Boundary pages

Supabase REST protection →

Mask PostgREST responses and stop filters from becoming inference oracles.

Schema-aware masking →

Configure which columns are protected and preserve compatible response types.

Security model →

Understand trust boundaries, credentials, identity, and bypass conditions.

Test the boundary on a real access path.

Start in observe mode, validate the policy against representative traffic, and move to enforcement with explicit bypass controls.

Get early access