Hello hackers, Currently views are not secure by default since they bypass RLS. PostgreSQL 15 introduced the `WITH (security_invoker = true)` option for this but it's easy to miss on every new view created.
It's also inconsistent with functions, which default to SECURITY INVOKER. I propose adding an option: `CREATE DATABASE .. SECURITY_INVOKER_VIEWS <bool>` (false by default to maintain backwards compat), so a database will have newly created views as SECURITY INVOKER. Let me know what you think. Best regards, Steve Chavez
