# Ensure Postgres functions have an explicit, fixed search_path

- Source: https://support.icompaas.com/support/solutions/articles/a_1790103902013978-ensure-postgres-functions-have-an-explicit-fixed-search_path
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Supabase cloud](https://support.icompaas.com/support/solutions/c_1790103054038308) › [supabase checks](https://support.icompaas.com/support/solutions/folders/f_1790103067540538)
- Last updated: 2026-09-22
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure every Postgres function in exposed schemas has a fixed search\_path set, preferably an empty string, and refers to objects with fully qualified names such as public.table\_name. This makes sure the function always uses the objects it was written for.

**Rationale**

If a function's search\_path is not fixed, it depends on the search\_path of the user calling it. An attacker who can create objects in a schema on that path could make the function use a fake table or function instead of the real one. This is especially dangerous for SECURITY DEFINER functions, which run with higher permissions.

**Impact**

-   Prevents functions from being tricked into using the wrong objects
    
-   Makes function behavior predictable
    
-   Functions may need fully qualified object names
    

**Default Value**

By default, Postgres functions do not have a fixed search\_path and use the caller's search\_path.

**Pre-Requisites**

-   Project Owner or Admin role
    
-   Access to the SQL Editor
    

**Test Plan**

1.  Sign in to the Supabase Dashboard at [https://supabase.com/dashboard](https://supabase.com/dashboard).
    
2.  Select your project.
    
3.  Open Advisors in the sidebar and select Security Advisor.
    
4.  Check for the finding Function Search Path Mutable.
    
5.  If any function is listed, follow the implementation steps.
    

**Implementation Steps**

1.  Sign in to the Supabase Dashboard at [https://supabase.com/dashboard](https://supabase.com/dashboard).
    
2.  Select your project.
    
3.  Open the SQL Editor in the sidebar.
    
4.  For each listed function, run: alter function public.<function\_name>(<argument types>) set search\_path = '';
    
5.  Update the function body to use fully qualified names (for example, public.orders) if needed.
    
6.  Test the function and rerun the Security Advisor.
    

**Backout Plan**

1.  Sign in to the Supabase Dashboard at [https://supabase.com/dashboard](https://supabase.com/dashboard).
    
2.  Select your project.
    
3.  Open the SQL Editor in the sidebar.
    
4.  Run: alter function public.<function\_name>(<argument types>) reset search\_path;
    

**Reference**

-   [https://supabase.com/docs/guides/database/database-advisors?lint=0011\_function\_search\_path\_mutable](https://supabase.com/docs/guides/database/database-advisors?lint=0011_function_search_path_mutable)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.