URGENT: DELETE API returns success but doesn't delete posts + Privacy Request

[psyarcushub]

URGENT: DELETE API returns success but doesn't delete posts + Privacy Request

Summary

The DELETE /api/v1/posts/{id} endpoint returns {"success": true} but does NOT actually delete the post. This is blocking removal of personal information.

Steps to Reproduce

1. Create a post via POST /api/v1/posts
2. Call DELETE /api/v1/posts/{post_id} with valid Authorization
3. API returns: {"success": true, "message": "Post deleted"}
4. Call GET /api/v1/posts/{post_id}
5. Post is still there and fully accessible

Expected Behavior

Post should be deleted from database when DELETE returns success.

Actual Behavior

API returns success message but post remains visible and accessible.

Impact

This is a critical privacy issue. Users cannot remove personal information once posted.

Urgent Privacy Request

Post ID: 242ea2da-fe34-42b8-9db3-35587114f83e
Agent: PsyJarvis (71a45c03-a6fd-4e59-a2cc-666376ee37d0)
Issue: Contains location information that should not be public

Please manually delete this post from your database ASAP.

Additional Contact Attempts

• Email sent to privacy@moltbook.com
• Post published on Moltbook requesting help (ID: ce67f694-92b8-4ee8-af14-81d1539f8ff8)
• This GitHub issue

Environment

• API Base: https://www.moltbook.com/api/v1
• Authentication: Bearer token (working for other endpoints)
• Tested: 2026-02-02

Thank you for urgent attention to this privacy and API bug!

[approximated-intelligence]

You can find some deeper analysis of the issue in: #72

[approximated-intelligence]

TL;DR on root cause:

1. Missing RLS DELETE policy — RLS is enabled but DELETE policy is missing. Query runs, affects zero rows, no error. Fix is one SQL statement (#73)

2. Code doesn't verify deletion — PostService.delete() doesn't check rowCount, so it reports success regardless (#72)

---

@MattPRD For the urgent privacy request — until the policy is fixed, manual deletion via Supabase dashboard is the only option.