Secvura

Pleasure! Let us know how you get along 😊

Good find, that pretty much settles it. The wrong logins during the week will most likely be the pre-launch crawler. It taps through the app and fills in any forms it finds with its own test input, so a login screen gets random usernames and passwords. You can check this in Play Console: each build's pre-launch report shows the devices it ran on, along with screenshots of what the crawler did, so you should be able to match those runs to what you're seeing in Cloudflare.

This sounds more like Google Play’s automated testing than rogue AI bots to me. Play runs pre-launch reports that automatically click through your app and interact with forms, and Google also asks for test credentials so reviewers can access restricted parts of the app. That could explain the random login attempts and the one successful login with your old credentials, although it’s hard to say for sure whether it’s the pre-launch crawler or Google’s review process. The WebView detail makes it worth checking rather than assuming. I’d check Play Console’s pre-launch reports and compare the timestamps with your build uploads. I’d also make sure the review account only has access to harmless test data, and that repeated failed logins are rate-limited. Did the earlier attempts coincide with other uploads, including internal testing, or were they happening when you hadn’t uploaded anything recently?

Adding to the security definer point above, views are worth a test too. A Postgres view runs with the owner’s permissions by default, so a view over a tenant table can skip RLS entirely unless it’s created with security\_invoker = true (Postgres 15+). One test that queries every view as a user from a different org would catch it.

The post mentions the managed version keeps the box updated, but how does that work for anyone on the open-source CLI route? With Postgres, auth and email all on one server, patching becomes the owner’s job. Would be good to know if updates are pushed or pulled, and how a bad update gets rolled back, before we’d put anything real on it.