Hi, I’m looking for confirmation about the default ACLs created by the pg_net extension in Supabase. On a staging project, after enabling pg_net and pg_cron, we observed: schema net exists; anon and authenticated have USAGE on schema net; has_function_privilege(..., 'EXECUTE') returns true for multiple net.* functions for both anon and authenticated; net and cron are NOT exposed through PostgREST; only public and graphql_public are exposed. We intend to use pg_net only server-side from a scheduled pg_cron maintenance job. Questions: Are these ACLs expected defaults for pg_net? Is it recommended/supported to revoke USAGE/EXECUTE from PUBLIC, anon, and authenticated? Which role(s) should retain privileges for a secure server-only pg_cron → pg_net workflow? Could extension upgrades recreate those default privileges? We want to harden the ACLs before enabling the scheduler.
The user is seeking confirmation about the default ACLs created by the pg_net extension in Supabase. They observed certain privileges granted to roles and are asking if these are expected defaults. They also inquire about best practices for revoking privileges and securing a server-only pg_cron to pg_net workflow.