Part 1 left one question open: does the RLS timing oracle survive the network? Against a live Supabase PostgREST API it does. Paired requests cancel jitter, and the network path only sets the price in requests.
Postgres row-level security guarantees the result set, not the execution time. LEAKPROOF operators let the planner visit withheld rows before the policy runs, and range predicates turn that timing difference into a binary search. Auto-generated REST layers hand ordinary clients exactly those predicates.
HTTP status codes are designed to be informative. That's exactly what makes them dangerous. Part 1 of a series on how RFC-compliant behavior creates exploitable information channels — and when breaking the spec is the right call.