X_DB_ROW_SECURITY_BYPASSED
Means
row security is on and the serving role is exempt from it
Typical cause
database.rowSecurity is on and the connected role is a superuser, has bypassrls, or owns a tenant table whose row security is not forced — Postgres exempts all three, so the policy would refuse nothing
Fix
psql "$DATABASE_URL" -c 'alter role <role> nosuperuser nobypassrls' # and serve as a role that owns no table: the migrator owns them, ROLE=migrate