@rebasepro/rls-check 0.17.3 → 0.18.0

package/dist/index.es.js

@@ -504,9 +504,71 @@ var listAnd = (items) => items.length <= 1 ? items[0] ?? "" : `${items.slice(0,
 function callerIdCall(snapshot) {
 	return snapshot.platform === "rebase" ? "rebase.uid()" : "auth.uid()";
 }
+/**
+* The helper functions a Rebase deployment creates in its `rebase` schema, as
+* they appear inside a policy expression. A call to one of these is the
+* strongest single signal that the policy was compiled from a collection's
+* `securityRules` rather than written by hand.
+*/
+var REBASE_HELPER_CALL = /\brebase\.(uid|roles|jwt|is_anonymous)\s*\(/i;
+/**
+* `<table>_<operation>_<7 hex>` — the name Rebase derives for a rule that does
+* not carry one of its own. The hash is of the rule's *semantics*, which is why
+* editing a rule abandons the old policy instead of updating it.
+*
+* Kept in step with `isGeneratedPolicyName` in
+* `packages/server-postgres/src/security/policy-drift.ts`, which is the
+* predicate the product itself uses to decide what it owns. This package cannot
+* import it — it ships with `pg` and nothing else so that `npx` is fast — so the
+* shape is restated here and anchored to the table for the same reason it is
+* there: a name that merely looks similar is not ours to reason about.
+*/
+function hasGeneratedPolicyName(policy) {
+	const table = policy.table.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+	return new RegExp(`^${table}_(select|insert|update|delete|all)_[0-9a-f]{7}(_\\d+)?$`).test(policy.name);
+}
+/**
+* Is this policy one Rebase derives from a collection's `securityRules` and
+* re-applies at every boot?
+*
+* It matters because the ordinary remediation — edit the policy in the database
+* — is *silently undone* on such a policy: boot drops and recreates every
+* generated policy from the collection config, so a fix applied with SQL
+* survives exactly until the next restart. Prescribing it is worse than
+* prescribing nothing, because the operator watches the finding disappear and
+* files it as done.
+*
+* Gated on the platform as well as the shape: this scanner is pointed at plenty
+* of databases Rebase did not create, and a hash-suffixed policy name on one of
+* those is a coincidence, not a contract.
+*/
+function isRebaseManagedPolicy(snapshot, policy) {
+	if (snapshot.platform !== "rebase") return false;
+	if (REBASE_HELPER_CALL.test(policy.using ?? "")) return true;
+	if (REBASE_HELPER_CALL.test(policy.withCheck ?? "")) return true;
+	return hasGeneratedPolicyName(policy);
+}
+/** Where the rule that produces a managed policy is documented. */
+var SECURITY_RULES_DOCS = "https://rebase.pro/docs/collections/security-rules";
+/**
+* The remediation for a Rebase-managed policy: change the rule it is compiled
+* from. `intent` is one clause saying what to change the rule to, in the
+* vocabulary of the check that found it.
+*
+* Deliberately contains no SQL. Every other fix in this tool is copy-pasteable
+* because pasting it works; here it would not, and an example that is reverted
+* on the next deploy teaches the wrong model of where access control lives.
+*/
+function managedPolicyFix(policy, intent) {
+	return `This policy is not hand-written: Rebase compiles it from the collection's
+\`securityRules\` and re-applies it (drop, then create) on every boot, so a
+change made to the policy in the database is undone the next time the runtime
+starts. Change the rule instead:
+  1. find the collection whose table is ${qrel(policy.schema, policy.table)} — in a scaffold,\n     under config/collections/;\n  2. ${intent};\n  3. a collection that declares no \`securityRules\` of its own inherits\n     \`defaultSecurityRules\` from config/collections/index.ts — a stock scaffold's\n     unfiltered read rule lives there, not on the collection;\n  4. redeploy (boot re-applies the policies), or run \`rebase db push\`.\n${SECURITY_RULES_DOCS}`;
+}
 //#endregion
 //#region src/checks/anonymous-write-allowed.ts
-var ID$13 = "anonymous-write-allowed";
+var ID$14 = "anonymous-write-allowed";
 var COMMANDS_FOR = {
 	ALL: [
 		"INSERT",
@@ -538,7 +600,7 @@ var COMMANDS_FOR = {
 * business of `policy-anonymous-tautology`, which can weigh the platform.
 */
 var anonymousWriteAllowed = {
-	id: ID$13,
+	id: ID$14,
 	title: "Unauthenticated callers can write",
 	description: "A permissive INSERT/UPDATE/DELETE policy reachable without authentication whose check expression accepts any row, backed by a matching grant.",
 	run(snapshot) {
@@ -565,7 +627,7 @@ var anonymousWriteAllowed = {
 			const commands = WRITE_PRIVILEGES.filter((p) => granted.has(p));
 			const verbs = commands.map((c) => c.toLowerCase());
 			findings.push(finding({
-				id: ID$13,
+				id: ID$14,
 				severity: "high",
 				confidence: "certain",
 				title: `${policy.schema}.${policy.table} accepts unauthenticated ${listAnd(verbs)} via policy "${policy.name}"`,
@@ -576,7 +638,7 @@ var anonymousWriteAllowed = {
 				},
 				detail: `Policy "${policy.name}" is a permissive ${policy.command} policy for ${listAnd(grantedTo)}, and its check expression ${policy.using == null && policy.withCheck == null ? "is absent, which Postgres treats as accepting every row" : "is a constant truth, so every row satisfies it"}. ${listAnd(grantedTo)} also ${grantedTo.length > 1 ? "hold" : "holds"} ${listAnd(commands)} on the table, so both the privilege check and the row check pass for a request that carries no credentials.`,
 				impact: `An unauthenticated caller reaching this database over an API can ${listAnd(verbs)} rows in ${policy.schema}.${policy.table} at will — inserting records attributed to other users, or ${commands.includes("DELETE") ? "deleting the table's contents" : "modifying rows they do not own"}.`,
-				fix: `-- Scope the write to the caller, or take the privilege away entirely:\nALTER POLICY ${qi(policy.name)} ON ${qrel(policy.schema, policy.table)}\n    WITH CHECK (user_id = ${uidCall});\n-- and if anonymous writes are never intended:\nREVOKE ${commands.join(", ")} ON ${qrel(policy.schema, policy.table)} FROM ${grantedTo.map((r) => r === "PUBLIC" ? "PUBLIC" : `"${r}"`).join(", ")};`
+				fix: isRebaseManagedPolicy(snapshot, policy) ? managedPolicyFix(policy, "scope the write rule to the caller (an `ownerField`) or restrict it to `roles` — and if anonymous writes are never intended, say so there rather than by revoking the grant, which boot re-makes") : `-- Scope the write to the caller, or take the privilege away entirely:\nALTER POLICY ${qi(policy.name)} ON ${qrel(policy.schema, policy.table)}\n    WITH CHECK (user_id = ${uidCall});\n-- and if anonymous writes are never intended:\nREVOKE ${commands.join(", ")} ON ${qrel(policy.schema, policy.table)} FROM ${grantedTo.map((r) => r === "PUBLIC" ? "PUBLIC" : `"${r}"`).join(", ")};`
 			}));
 		}
 		return findings;
@@ -610,7 +672,7 @@ function acceptsAnyRow(policy) {
 }
 //#endregion
 //#region src/checks/current-setting-throws.ts
-var ID$12 = "current-setting-throws";
+var ID$13 = "current-setting-throws";
 /**
 * `current_setting('x')` in a policy, without the `missing_ok` second argument.
 *
@@ -625,7 +687,7 @@ var ID$12 = "current-setting-throws";
 * the check cannot see the session that will run the query.
 */
 var currentSettingThrows = {
-	id: ID$12,
+	id: ID$13,
 	title: "Policy calls current_setting() without missing_ok",
 	description: "A policy expression calling current_setting('x') with one argument, which raises rather than returning NULL when the setting is unset.",
 	run(snapshot) {
@@ -643,7 +705,7 @@ var currentSettingThrows = {
 			if (settings.size === 0) continue;
 			const names = [...settings];
 			findings.push(finding({
-				id: ID$12,
+				id: ID$13,
 				severity: "low",
 				confidence: "heuristic",
 				title: `Policy "${policy.name}" on ${policy.schema}.${policy.table} calls current_setting(${names.map((n) => `'${n}'`).join(", ")}) without missing_ok`,
@@ -654,7 +716,7 @@ var currentSettingThrows = {
 				},
 				detail: `The ${clauses.join(" and ")} expression calls \`current_setting\` with a single argument. When ${names.length === 1 ? "that setting has" : "those settings have"} not been set in the session, the call raises \`unrecognized configuration parameter\` instead of returning NULL — so the policy cannot evaluate to false, it errors. Passing \`true\` as the second argument makes it return NULL, which the policy then treats as "no match" and denies the row, as intended.`,
 				impact: `A request that reaches this table without ${names.join(" / ")} set fails with a database error rather than being denied. The caller sees a 500 rather than an empty result, and any middleware that retries 5xx responses will retry a request that can never succeed.`,
-				fix: `-- Add the missing_ok argument so an unset value denies instead of raising:\nALTER POLICY ${qi(policy.name)} ON ${qrel(policy.schema, policy.table)}\n    USING (tenant_id = current_setting('${names[0]}', true)::uuid);`
+				fix: isRebaseManagedPolicy(snapshot, policy) ? managedPolicyFix(policy, `pass the missing_ok argument in the rule's raw SQL — \`current_setting('${names[0]}', true)\` — so an unset value denies instead of raising`) : `-- Add the missing_ok argument so an unset value denies instead of raising:\nALTER POLICY ${qi(policy.name)} ON ${qrel(policy.schema, policy.table)}\n    USING (tenant_id = current_setting('${names[0]}', true)::uuid);`
 			}));
 		}
 		return findings;
@@ -681,7 +743,7 @@ function singleArgumentSettings(expr) {
 }
 //#endregion
 //#region src/checks/grant-to-public.ts
-var ID$11 = "grant-to-public";
+var ID$12 = "grant-to-public";
 /**
 * A DML privilege granted to PUBLIC.
 *
@@ -693,7 +755,7 @@ var ID$11 = "grant-to-public";
 * separately and with more force.
 */
 var grantToPublic = {
-	id: ID$11,
+	id: ID$12,
 	title: "Table privileges granted to PUBLIC",
 	description: "A SELECT/INSERT/UPDATE/DELETE privilege granted to PUBLIC on a table.",
 	run(snapshot) {
@@ -706,7 +768,7 @@ var grantToPublic = {
 			const privileges = DML.filter((p) => grant.privileges.includes(p));
 			if (privileges.length === 0) continue;
 			findings.push(finding({
-				id: ID$11,
+				id: ID$12,
 				severity: "medium",
 				confidence: "certain",
 				title: `${grant.schema}.${grant.table} grants ${listAnd(privileges)} to PUBLIC`,
@@ -724,7 +786,7 @@ var grantToPublic = {
 };
 //#endregion
 //#region src/checks/junction-table-unprotected.ts
-var ID$10 = "junction-table-unprotected";
+var ID$11 = "junction-table-unprotected";
 /** Bookkeeping columns a join table is allowed to carry without ceasing to be one. */
 var INCIDENTAL_COLUMNS = /* @__PURE__ */ new Set([
 	"id",
@@ -754,7 +816,7 @@ var INCIDENTAL_COLUMNS = /* @__PURE__ */ new Set([
 * that happens to have two foreign keys, and is not reported here.
 */
 var junctionTableUnprotected = {
-	id: ID$10,
+	id: ID$11,
 	title: "Many-to-many join table without RLS",
 	description: "A table that is essentially just two foreign keys, both pointing at RLS-protected tables, that has no row-level security of its own.",
 	run(snapshot) {
@@ -769,7 +831,7 @@ var junctionTableUnprotected = {
 			if (!fks.map((fk) => relationAt(snapshot, fk.refSchema, fk.refTable)).every((t) => t?.rlsEnabled)) continue;
 			if (!isMostlyKeys(rel, fks.flatMap((fk) => fk.columns))) continue;
 			findings.push(finding({
-				id: ID$10,
+				id: ID$11,
 				severity: "high",
 				confidence: "heuristic",
 				title: `${rel.schema}.${rel.name} joins ${endpoints[0]} to ${endpoints[1]}, and is the only one of the three without RLS`,
@@ -796,7 +858,7 @@ function isMostlyKeys(rel, keyColumns) {
 }
 //#endregion
 //#region src/checks/view-bypasses-rls.ts
-var ID$9 = "view-bypasses-rls";
+var ID$10 = "view-bypasses-rls";
 /** Base relations of `view` that have RLS turned on. */
 function protectedBaseTables(snapshot, view) {
 	return view.dependsOn.map((d) => relationAt(snapshot, d.schema, d.table)).filter((r) => Boolean(r?.rlsEnabled)).map((r) => `${r.schema}.${r.name}`);
@@ -816,7 +878,7 @@ function protectedBaseTables(snapshot, view) {
 * mistake, so those findings are marked heuristic.
 */
 var viewBypassesRls = {
-	id: ID$9,
+	id: ID$10,
 	title: "View reads past its base table's RLS",
 	description: "A view granted to an untrusted role that selects from an RLS-protected table and runs with its owner's privileges instead of the caller's.",
 	run(snapshot) {
@@ -833,7 +895,7 @@ var viewBypassesRls = {
 			const roles = exposed.map((e) => e.role);
 			const legacy = view.securityInvoker === null;
 			findings.push(finding({
-				id: ID$9,
+				id: ID$10,
 				severity: "critical",
 				confidence: legacy ? "heuristic" : "certain",
 				title: `View ${view.schema}.${view.name} reads ${listAnd(bases)} without security_invoker and is readable by ${listAnd(roles)}`,
@@ -854,7 +916,7 @@ REVOKE SELECT ON ${qrel(view.schema, view.name)} FROM ${qrole(roles[0])};\n--
 };
 //#endregion
 //#region src/checks/matview-bypasses-rls.ts
-var ID$8 = "matview-bypasses-rls";
+var ID$9 = "matview-bypasses-rls";
 /**
 * A materialized view over an RLS-protected table, readable by an untrusted role.
 *
@@ -865,7 +927,7 @@ var ID$8 = "matview-bypasses-rls";
 * only controls are the grant and what the defining query selects.
 */
 var matviewBypassesRls = {
-	id: ID$8,
+	id: ID$9,
 	title: "Materialized view exposes RLS-protected data",
 	description: "A materialized view granted to an untrusted role whose defining query reads a table with row-level security enabled.",
 	run(snapshot) {
@@ -879,7 +941,7 @@ var matviewBypassesRls = {
 			if (exposed.length === 0) continue;
 			const roles = exposed.map((e) => e.role);
 			findings.push(finding({
-				id: ID$8,
+				id: ID$9,
 				severity: "high",
 				confidence: "certain",
 				title: `Materialized view ${view.schema}.${view.name} snapshots ${listAnd(bases)} and is readable by ${listAnd(roles)}`,
@@ -898,7 +960,7 @@ var matviewBypassesRls = {
 };
 //#endregion
 //#region src/checks/policy-always-true.ts
-var ID$7 = "policy-always-true";
+var ID$8 = "policy-always-true";
 /**
 * A PERMISSIVE policy whose expression is a constant truth, targeted at a role
 * an untrusted caller reaches.
@@ -915,7 +977,7 @@ var ID$7 = "policy-always-true";
 * cover the same rows).
 */
 var policyAlwaysTrue = {
-	id: ID$7,
+	id: ID$8,
 	title: "Policy grants unconditional access",
 	description: "A permissive policy whose USING or WITH CHECK expression is always true.",
 	run(snapshot) {
@@ -935,7 +997,7 @@ var policyAlwaysTrue = {
 			const verb = policy.command === "SELECT" ? "read" : "act on";
 			const severity = gate ? "medium" : "critical";
 			findings.push(finding({
-				id: ID$7,
+				id: ID$8,
 				severity,
 				confidence: gate ? "heuristic" : "certain",
 				title: `Policy "${policy.name}" on ${policy.schema}.${policy.table} is ${listAnd(clauses)} (true) for ${listAnd(exposed)}`,
@@ -946,7 +1008,7 @@ var policyAlwaysTrue = {
 				},
 				detail: `This permissive ${policy.command} policy's ${listAnd(clauses)} expression is a constant truth, so it matches every row for ${listAnd(exposed)}. Permissive policies are ORed together, so this one alone satisfies the table's row filter no matter how strict the others are.` + (gate ? ` A RESTRICTIVE policy ("${gate}") also applies to this command and is ANDed after it, so access may still be gated — verify that restrictive policy covers the rows and roles you expect, because nothing else here does.` : ""),
 				impact: gate ? `Row filtering on this table rests entirely on the RESTRICTIVE policy "${gate}". If it does not cover a case, ${listAnd(exposed)} can ${verb} every row${rowsPhrase(rel)}.` : `If this table is reachable over an API as ${listAnd(exposed)}, a caller can ${verb} every row${rowsPhrase(rel)} — the policy applies no scoping whatsoever.`,
-				fix: `-- Replace the constant with the scoping you intended, e.g.:\nALTER POLICY ${qi(policy.name)} ON ${qrel(policy.schema, policy.table)}\n    ${clauses.includes("USING") ? `USING (user_id = ${uidCall})` : `WITH CHECK (user_id = ${uidCall})`};\n-- or, if unconditional access really is intended, drop the policy and say so\n-- with an explicit grant instead:\n-- DROP POLICY ${qi(policy.name)} ON ${qrel(policy.schema, policy.table)};`
+				fix: isRebaseManagedPolicy(snapshot, policy) ? managedPolicyFix(policy, `replace the rule that grants unconditional ${policy.command === "SELECT" ? "reads" : "access"} with one that scopes the rows — \`ownerField\`, \`roles\`, or a \`condition\``) : `-- Replace the constant with the scoping you intended, e.g.:\nALTER POLICY ${qi(policy.name)} ON ${qrel(policy.schema, policy.table)}\n    ${clauses.includes("USING") ? `USING (user_id = ${uidCall})` : `WITH CHECK (user_id = ${uidCall})`};\n-- or, if unconditional access really is intended, drop the policy and say so\n-- with an explicit grant instead:\n-- DROP POLICY ${qi(policy.name)} ON ${qrel(policy.schema, policy.table)};`
 			}));
 		}
 		return findings;
@@ -957,8 +1019,30 @@ function restrictiveGate(snapshot, policy) {
 	return snapshot.policies.find((p) => !p.permissive && p.schema === policy.schema && p.table === policy.table && (p.command === "ALL" || policy.command === "ALL" || p.command === policy.command))?.name ?? null;
 }
 //#endregion
+//#region src/types.ts
+/**
+* The contract between the three layers of `rls-check`:
+*
+*   introspect.ts  — reads the catalogs into a {@link DbSnapshot}. Talks to Postgres.
+*   checks/*.ts    — pure functions, snapshot in, {@link Finding}s out. No I/O.
+*   report.ts      — Findings to text or JSON. No knowledge of Postgres.
+*
+* Checks being pure is the point: every one of them is unit-testable against a
+* hand-written snapshot, so the test suite does not need a live database to
+* cover the interesting cases (it has a Docker-backed suite too, for the
+* introspection layer, which is the only part that can lie).
+*/
+/** Ordered least → most severe; the CLI's `--fail-on` compares by index. */
+var SEVERITIES = [
+	"info",
+	"low",
+	"medium",
+	"high",
+	"critical"
+];
+//#endregion
 //#region src/checks/policy-anonymous-tautology.ts
-var ID$6 = "policy-anonymous-tautology";
+var ID$7 = "policy-anonymous-tautology";
 /**
 * `auth.uid() IS NOT NULL` and its relatives.
 *
@@ -977,17 +1061,18 @@ var ID$6 = "policy-anonymous-tautology";
 *   - Anything else: it comes down to whether the stack coerces, which the
 *     database cannot tell us. `medium`, and say so out loud.
 *
-* A `<> 'anonymous'` guard alongside the null test is the corrected form and
-* clears the policy entirely.
+* A guard that excludes the sentinel is the corrected form and clears the policy.
+* A guard that excludes *something else* is the interesting case — see
+* {@link matchTautology}.
 */
 var policyAnonymousTautology = {
-	id: ID$6,
+	id: ID$7,
 	title: "Policy only checks that a caller id exists",
 	description: "A policy whose expression is `auth.uid() IS NOT NULL`-shaped: it separates signed-in from signed-out callers but scopes no rows.",
 	run(snapshot) {
 		const uidCall = callerIdCall(snapshot);
 		const findings = [];
-		const { severity, meaning, impactSuffix } = platformReading(snapshot.platform);
+		const { severity: baseSeverity, meaning, impactSuffix } = platformReading(snapshot.platform);
 		for (const policy of snapshot.policies) {
 			if (!snapshot.schemas.includes(policy.schema)) continue;
 			if (!policy.permissive) continue;
@@ -998,25 +1083,43 @@ var policyAnonymousTautology = {
 			if (usingMatch) clauses.push("USING");
 			if (checkMatch) clauses.push("WITH CHECK");
 			if (clauses.length === 0) continue;
-			const shape = usingMatch ?? checkMatch ?? "the caller id";
+			const shape = usingMatch?.shape ?? checkMatch?.shape ?? "the caller id";
+			const decoys = [.../* @__PURE__ */ new Set([...usingMatch?.decoyGuards ?? [], ...checkMatch?.decoyGuards ?? []])];
+			const severity = forCommand(baseSeverity, policy.command);
+			const written = decoys.map((d) => `\`${shape} <> '${d}'\``);
 			findings.push(finding({
-				id: ID$6,
+				id: ID$7,
 				severity,
 				confidence: "heuristic",
-				title: `Policy "${policy.name}" on ${policy.schema}.${policy.table} only checks that ${shape} is not null`,
+				title: decoys.length > 0 ? `Policy "${policy.name}" on ${policy.schema}.${policy.table} excludes ${listAnd(decoys.map((d) => `'${d}'`))}, which is not the anonymous sentinel` : `Policy "${policy.name}" on ${policy.schema}.${policy.table} only checks that ${shape} is not null`,
 				target: {
 					schema: policy.schema,
 					table: policy.table,
 					policy: policy.name
 				},
-				detail: `The ${listAnd(clauses)} expression of this ${policy.command} policy tests only that ${shape} is non-null. It does not compare anything to a column, so every row of the table satisfies it equally — the policy distinguishes signed-in from signed-out callers and nothing else. ${meaning}`,
-				impact: `Any caller for whom ${shape} is non-null can reach every row this policy covers, including rows belonging to other users or tenants. ${impactSuffix}`,
-				fix: `-- Scope the policy to the row's owner rather than to the existence of an id:\nALTER POLICY ${qi(policy.name)} ON ${qrel(policy.schema, policy.table)}\n    USING (user_id = ${uidCall});\n-- If the intent really is "any signed-in user", make that explicit and make it\n-- reject the anonymous sentinel your stack may use:\n--     USING (${uidCall} IS NOT NULL AND ${uidCall} <> 'anonymous');`
+				detail: (decoys.length > 0 ? `The ${listAnd(clauses)} expression of this ${policy.command} policy reads as "signed in": it tests that ${shape} is non-null and excludes ${listAnd(written)}. But the id a signed-out caller actually arrives with is ${listAnd(CLEARING_SENTINELS.map(describeSentinel))}, and neither is ${listAnd(decoys.map((d) => `'${d}'`))} — so the guard excludes nobody and the null test stands on its own. ` : `The ${listAnd(clauses)} expression of this ${policy.command} policy tests only that ${shape} is non-null. `) + `It does not compare anything to a column, so every row of the table satisfies it equally — the policy distinguishes signed-in from signed-out callers and nothing else. ${meaning}` + (policy.command === "ALL" || policy.command === "UPDATE" || policy.command === "DELETE" ? ` This policy governs ${policy.command === "ALL" ? "every command, writes included" : policy.command}, so the same expression decides who may change rows, not only who may read them.` : ""),
+				impact: `Any caller for whom ${shape} is non-null can reach every row this policy covers, including rows belonging to other users or tenants. ${impactSuffix}` + (decoys.length > 0 ? " A policy in this shape reads as safe on review, which is why it survives: the guard is present, spelled plausibly, and matches nothing." : ""),
+				fix: isRebaseManagedPolicy(snapshot, policy) ? managedPolicyFix(policy, "scope the rule to the row's owner (an `ownerField`) rather than to the existence of an id — `access: \"authenticated\"` compiled to exactly this shape before 1.0, so a database pushed then still carries it") : `-- Scope the policy to the row's owner rather than to the existence of an id:\nALTER POLICY ${qi(policy.name)} ON ${qrel(policy.schema, policy.table)}\n    USING (user_id = ${uidCall});\n-- If the intent really is "any signed-in user", exclude every id your stack has\n-- ever used for "nobody" — one literal is not enough:\n--     USING (${uidCall} IS NOT NULL AND ${uidCall} <> ALL (ARRAY['anonymous', 'anon']));`
 			}));
 		}
 		return findings;
 	}
 };
+/**
+* Writes are worse than reads.
+*
+* The platform decides whether this expression is a bypass at all; the command
+* decides what it costs when it is. A `FOR ALL` policy in this shape governed
+* `UPDATE` and `DELETE` on a live users table — an anonymous PATCH setting
+* `roles: ["admin"]` was reachable through it — while the same predicate under
+* `FOR SELECT` would only have leaked. One step, not two: the platform reading
+* is still the dominant term.
+*/
+function forCommand(base, command) {
+	if (command !== "ALL" && command !== "UPDATE" && command !== "DELETE") return base;
+	return SEVERITIES[Math.min(SEVERITIES.indexOf(base) + 1, SEVERITIES.length - 1)];
+}
+var describeSentinel = (s) => s === "" ? "the empty string" : `'${s}'`;
 function platformReading(platform) {
 	switch (platform) {
 		case "supabase": return {
@@ -1069,27 +1172,250 @@ var CALLER_ID_CALLS = [
 	}
 ];
 /**
-* Recognise `<caller-id expression> IS NOT NULL` and name what was tested — but
-* only when that is the *entire* expression.
+* The ids that a signed-out caller can actually arrive with, so excluding one of
+* them is a real guard.
 *
-* The "entire" part is what keeps this check honest. `auth.uid() IS NOT NULL AND
-* user_id = auth.uid()` contains the shape and is a perfectly scoped policy; a
-* substring match would flag it, and flagging correct Supabase policies is the
-* fastest way to get this tool deleted. So the caller-id call is substituted for
-* a placeholder, casts, parens, `SELECT` wrappers and whitespace are stripped,
-* and what remains has to be exactly `<placeholder> is not null`.
+* `'anonymous'` is Rebase's `ANONYMOUS_USER_ID`; the empty string is what a
+* PostgREST-shaped stack leaves an unset claim as. Deliberately **not** the whole
+* of Rebase's `ANONYMOUS_USER_IDS`: that list also carries `'anon'`, the id the
+* request path reported before the sentinel was unified, and a policy excluding
+* only `'anon'` does not exclude anyone on any server shipping today. Treating
+* `'anon'` as clearing is exactly the mistake this check now exists to catch.
 */
-function matchTautology(clause) {
+var CLEARING_SENTINELS = ["anonymous", ""];
+/**
+* Recognise "the policy tests that a caller id exists, and nothing that narrows
+* which rows" — and report which no-op guards it wears while doing so.
+*
+* Two rules keep this honest.
+*
+* **Every conjunct has to be accounted for.** `auth.uid() IS NOT NULL AND user_id
+* = auth.uid()` contains the shape and is a perfectly scoped policy; a substring
+* match would flag it, and flagging correct Supabase policies is the fastest way
+* to get this tool deleted. So the expression is split on `AND`, each conjunct is
+* classified, and a single conjunct this function does not recognise means it
+* stays quiet. An `OR` anywhere means the same — the shape no longer describes
+* what the policy admits.
+*
+* **A guard only clears if it excludes an id somebody can actually arrive with.**
+* The version before this one bailed on the literal string `<> 'anonymous'`, which
+* meant `<> 'anon'` fell past the bail and then failed to match the bare-null-test
+* shape, so the function returned null and the check said nothing at all. That is
+* not a near miss: it is the precise predicate that left a production `users`
+* table — password hashes included — readable by the entire internet for three and
+* a half weeks, and this tool was run against that database and reported clean.
+* A guard naming the wrong literal is now the *loudest* case, not the silent one,
+* because it is the one that survives code review.
+*/
+function callerIdOnlyClause(clause) {
 	if (!clause) return null;
-	const flat = clause.toLowerCase().replace(/\s+/g, " ");
-	if (/(<>|!=)\s*'anonymous'/.test(flat) || /(<>|!=)\s*''/.test(flat)) return null;
+	const flat = clause.toLowerCase().replace(/::\s*[a-z0-9_]+(?:\s*\[\s*\])*/g, "").replace(/\s+/g, " ").trim();
 	for (const { re, label } of CALLER_ID_CALLS) {
 		const first = new RegExp(re.source).exec(flat);
 		if (!first) continue;
-		if (flat.replace(new RegExp(re.source, "g"), "callerid").replace(/::[a-z0-9_[\]]+/g, "").replace(/\bselect\b/g, "").replace(/\bas [a-z0-9_]+/g, "").replace(/[()\s]/g, "") === "calleridisnotnull") return label(first);
+		const substituted = flat.replace(new RegExp(re.source, "g"), " callerid ");
+		if (/\bor\b/.test(substituted)) return null;
+		let sawNullTest = false;
+		const decoys = [];
+		let cleared = false;
+		for (const raw of splitTopLevelAnd(substituted)) {
+			const conjunct = canon(raw);
+			if (conjunct === "") continue;
+			if (conjunct === "callerid is not null") {
+				sawNullTest = true;
+				continue;
+			}
+			const excluded = excludedLiterals(conjunct);
+			if (!excluded) return null;
+			if (excluded.some((lit) => CLEARING_SENTINELS.includes(lit))) cleared = true;
+			decoys.push(...excluded);
+		}
+		if (!sawNullTest) continue;
+		if (cleared) return {
+			shape: label(first),
+			decoyGuards: [...new Set(decoys)],
+			guardsSentinel: true
+		};
+		return {
+			shape: label(first),
+			decoyGuards: [...new Set(decoys)],
+			guardsSentinel: false
+		};
 	}
 	return null;
 }
+/**
+* The subset of {@link callerIdOnlyClause} that *this* check reports: a bare
+* null test wearing no guard that excludes a real signed-out id.
+*
+* A clause that does exclude the sentinel is not clean, it is a different
+* finding with a different severity and a different fix, and
+* `policy-authenticated-tautology` reports it from the same parse.
+*/
+function matchTautology(clause) {
+	const matched = callerIdOnlyClause(clause);
+	return matched && !matched.guardsSentinel ? matched : null;
+}
+/**
+* Split on `AND`, counting parens.
+*
+* A plain `.split(/\band\b/)` is what the first attempt used and it does not
+* survive contact with Postgres, which reads an expression back fully
+* parenthesised: `((uid() IS NOT NULL) AND (uid() <> 'anon'))` splits into two
+* fragments with unbalanced parens, neither of which matches anything, so the
+* check goes quiet on precisely the input it exists for. Depth is tracked, quoted
+* literals are skipped so an `and` inside a string is not a separator, and each
+* part is re-split so nested conjunctions flatten.
+*/
+function splitTopLevelAnd(expr) {
+	const s = peel(expr);
+	const parts = [];
+	let depth = 0;
+	let inQuote = false;
+	let start = 0;
+	for (let i = 0; i < s.length; i++) {
+		const ch = s[i];
+		if (ch === "'") {
+			inQuote = !inQuote;
+			continue;
+		}
+		if (inQuote) continue;
+		if (ch === "(") depth++;
+		else if (ch === ")") depth--;
+		else if (depth === 0 && s.startsWith("and", i) && isWord(s, i, 3)) {
+			parts.push(s.slice(start, i));
+			i += 2;
+			start = i + 1;
+		}
+	}
+	parts.push(s.slice(start));
+	return parts.length === 1 ? parts : parts.flatMap(splitTopLevelAnd);
+}
+/** `and` as a whole word, not the tail of `brand` or the head of `android`. */
+function isWord(s, at, length) {
+	const before = at === 0 ? "" : s[at - 1];
+	const after = s[at + length] ?? "";
+	return !/[a-z0-9_]/.test(before) && !/[a-z0-9_]/.test(after);
+}
+/** Remove balanced wrapping parens: `((x))` -> `x`, but `(a) and (b)` is left alone. */
+function peel(fragment) {
+	let s = fragment.trim();
+	while (s.startsWith("(") && s.endsWith(")") && balanced(s.slice(1, -1))) s = s.slice(1, -1).trim();
+	return s;
+}
+/** Strip the noise Postgres adds when it rewrites an expression. */
+function canon(fragment) {
+	let s = peel(fragment.replace(/\bselect\b/g, " ").replace(/\bas [a-z0-9_]+/g, " ").replace(/\s+/g, " "));
+	let previous;
+	do {
+		previous = s;
+		s = peel(s.replace(/\(\s*(callerid)\s*\)/g, "$1").trim());
+	} while (s !== previous);
+	return s.replace(/\s+/g, " ").trim();
+}
+function balanced(s) {
+	let depth = 0;
+	for (const ch of s) if (ch === "(") depth++;
+	else if (ch === ")" && --depth < 0) return false;
+	return depth === 0;
+}
+/**
+* The literals a conjunct excludes the caller id from, or `null` if the conjunct
+* is not an exclusion at all.
+*
+* `null` is the conservative answer and the common one: `user_id = callerid`
+* lands here and silences the whole check, which is correct, because that
+* conjunct scopes rows.
+*/
+function excludedLiterals(conjunct) {
+	let m = /^callerid (?:<>|!=) '([^']*)'$/.exec(conjunct);
+	if (m) return [m[1]];
+	m = /^'([^']*)' (?:<>|!=) callerid$/.exec(conjunct);
+	if (m) return [m[1]];
+	m = /^callerid (?:<>|!=) all \( ?array \[(.*)\] ?\)$/.exec(conjunct);
+	if (m) return literalList(m[1]);
+	m = /^callerid not in \((.*)\)$/.exec(conjunct);
+	if (m) return literalList(m[1]);
+	return null;
+}
+/** `'a', 'b'` -> `["a", "b"]`; `null` if any element is not a plain literal. */
+function literalList(inner) {
+	const out = [];
+	for (const part of inner.split(",")) {
+		const m = /^ ?'([^']*)' ?$/.exec(part);
+		if (!m) return null;
+		out.push(m[1]);
+	}
+	return out.length > 0 ? out : null;
+}
+//#endregion
+//#region src/checks/policy-authenticated-tautology.ts
+var ID$6 = "policy-authenticated-tautology";
+/**
+* `auth.uid() IS NOT NULL AND auth.uid() <> 'anonymous'` — and nothing else.
+*
+* This is the *corrected* form of the anonymous tautology, and correcting that
+* one is where people stop. It genuinely does exclude signed-out callers. What
+* it does not do is scope any rows: what remains is "every registered account
+* may read every row of this table", which is a different sentence from the one
+* the person writing it usually means.
+*
+* It is the shape that leaked a customer's `users` table — every email address
+* on the platform, and the columns beside them, readable by anyone who could
+* sign up, which on a product with open registration is anyone at all. The
+* scanner watched for the anonymous form and treated the sentinel guard as a
+* clean bill of health, so the policy that actually shipped passed silently.
+*
+* `high`, not `critical`: it costs an account. On a table with open
+* registration that is a formality, and the wording says so rather than
+* pretending the distinction is comforting.
+*
+* Not folded into {@link policyAnonymousTautology}: check ids appear in
+* `--skip`, in CI baselines and in people's runbooks, so two findings with
+* different fixes and different severities have to be two ids. Someone who has
+* decided their `countries` table really is world-readable should be able to
+* silence that without also silencing "signed-out callers can read it".
+*/
+var policyAuthenticatedTautology = {
+	id: ID$6,
+	title: "Policy admits every signed-in caller to every row",
+	description: "A policy whose expression is only \"the caller is signed in and not anonymous\": it excludes signed-out callers correctly and scopes no rows between accounts.",
+	run(snapshot) {
+		const uidCall = callerIdCall(snapshot);
+		const findings = [];
+		for (const policy of snapshot.policies) {
+			if (!snapshot.schemas.includes(policy.schema)) continue;
+			if (!policy.permissive) continue;
+			if (policyTargetsExposedRole(snapshot, policy).length === 0) continue;
+			const usingMatch = callerIdOnlyClause(policy.using);
+			const checkMatch = callerIdOnlyClause(policy.withCheck);
+			const clauses = [];
+			if (usingMatch?.guardsSentinel) clauses.push("USING");
+			if (checkMatch?.guardsSentinel) clauses.push("WITH CHECK");
+			if (clauses.length === 0) continue;
+			const shape = (usingMatch?.guardsSentinel ? usingMatch.shape : checkMatch?.shape) ?? "the caller id";
+			findings.push(finding({
+				id: ID$6,
+				severity: "high",
+				confidence: "heuristic",
+				title: `Policy "${policy.name}" on ${policy.schema}.${policy.table} admits every signed-in caller to every row`,
+				target: {
+					schema: policy.schema,
+					table: policy.table,
+					policy: policy.name
+				},
+				detail: `The ${listAnd(clauses)} expression of this ${policy.command} policy tests that ${shape} exists and is not the anonymous sentinel, and tests nothing else. That correctly excludes signed-out callers — and it compares nothing to a column, so every row of the table satisfies it equally for every account that does sign in.`,
+				impact: "Any user with an account reaches every row this policy covers, including rows belonging to other users and other tenants. Where registration is open, \"any user with an account\" is anybody who fills in a form. This is the shape that makes a `users` table — every address on the platform — readable by its own members.",
+				fix: isRebaseManagedPolicy(snapshot, policy) ? managedPolicyFix(policy, "scope the rule to the row rather than to the existence of a session — an `ownerField`, or a `condition` naming the group whose members may share rows") : `-- Scope the policy to the row, rather than to the existence of a session:
+ALTER POLICY ${qi(policy.name)} ON ${qrel(policy.schema, policy.table)}\n    USING (user_id = ${uidCall});\n-- Or, where members of a shared group really may see each other's rows, say
+-- which group:
+--     USING (EXISTS (SELECT 1 FROM memberships m\n--                    WHERE m.org_id = ${policy.table}.org_id AND m.user_id = ${uidCall}));\n-- If the table genuinely is readable by every account, keep this policy and
+-- skip the finding: rls-check --skip ${ID$6}`
+			}));
+		}
+		return findings;
+	}
+};
 //#endregion
 //#region src/checks/policy-role-unreachable.ts
 var ID$5 = "policy-role-unreachable";
@@ -1134,7 +1460,7 @@ var policyRoleUnreachable = {
 				},
 				detail: `Row-level security is enabled on this table and every policy names only ${named.join(", ")}. ` + (missing.length > 0 ? `${missing.join(", ")} ${missing.length === 1 ? "does" : "do"} not exist in pg_roles at all. ` : "") + `None of these roles can log in, and no login role is a member of ${named.length === 1 ? "it" : "any of them"}, so no session ever has these policies applied. RLS with no applicable policy denies every row.`,
 				impact: `Reads of this table return zero rows for every application role, and writes are rejected. Nothing is exposed — the data is invisible instead, and it looks identical to an empty table, which is why this usually goes unnoticed for a long time. The owner (${rel.owner}) still sees everything${rel.rlsForced ? " unless FORCE ROW LEVEL SECURITY changes that" : ", since FORCE ROW LEVEL SECURITY is not set"}.`,
-				fix: `-- Point the policies at the role your requests actually arrive as. Confirm it with:
+				fix: policies.every((p) => isRebaseManagedPolicy(snapshot, p)) ? managedPolicyFix(policies[0], "name the role your requests actually arrive as in the rules' `roles` — confirm it with `SELECT current_user` from the application's own connection") : `-- Point the policies at the role your requests actually arrive as. Confirm it with:
 --     SELECT current_user;   -- run this from your application's connection
 ALTER POLICY ${qi(policies[0].name)} ON ${qrel(rel.schema, rel.name)} TO <that role>;\n-- Alternatively, if ${named[0]} is meant to be reachable, grant membership:\n-- GRANT ${qi(named[0])} TO <your login role>;`
 			}));
@@ -1398,7 +1724,7 @@ var unqualifiedColumnInSubquery = {
 			for (const clause of ["USING", "WITH CHECK"]) {
 				const expr = clause === "USING" ? policy.using : policy.withCheck;
 				if (!expr) continue;
-				for (const hit of scanExpression(snapshot, outer, expr)) findings.push(buildFinding(policy, outer, clause, hit));
+				for (const hit of scanExpression(snapshot, outer, expr)) findings.push(buildFinding(snapshot, policy, outer, clause, hit));
 			}
 		}
 		return findings;
@@ -1595,7 +1921,7 @@ function resolveRelation(snapshot, policySchema, item) {
 	const candidates = snapshot.relations.filter((r) => r.name === item.name && snapshot.schemas.includes(r.schema));
 	return candidates.length === 1 ? candidates[0] : void 0;
 }
-function buildFinding(policy, outer, clause, hit) {
+function buildFinding(snapshot, policy, outer, clause, hit) {
 	return finding({
 		id: ID,
 		severity: "high",
@@ -1609,7 +1935,7 @@ function buildFinding(policy, outer, clause, hit) {
 		},
 		detail: `In the ${clause} expression, \`${hit.column}\` is written unqualified inside a subquery over ${hit.inner}, compared against \`${hit.comparedTo}\`. Both ${hit.inner} and ${policy.schema}.${policy.table} have a column named \`${hit.column}\`, and Postgres resolves the bare name against the innermost scope that has it — so it binds to ${hit.inner}.${hit.column}, not to the outer row. If the intent was to correlate the subquery with the row being checked, that correlation is not happening.\n\nNote that \`pg_policies\` shows Postgres's own re-rendering of the policy, which usually re-qualifies column references. A match here means the ambiguity survived that rewrite, so it is strong evidence — but the absence of a match on other policies is not proof that they are unambiguous.`,
 		impact: "The predicate does not mean what it reads like. Depending on the data it either matches far more rows than intended — exposing other users' or tenants' rows to anyone the policy applies to — or, if the inner comparison is never satisfiable, matches none, and the table silently returns empty results.",
-		fix: `-- Qualify every reference so the binding is explicit:\nALTER POLICY ${qi(policy.name)} ON ${qrel(policy.schema, policy.table)}\n    ${clause === "USING" ? "USING" : "WITH CHECK"} (EXISTS (\n        SELECT 1 FROM ${hit.inner}\n        WHERE ${hit.inner}.${hit.comparedTo.includes(".") ? hit.comparedTo.split(".").pop() : hit.comparedTo}\n            = ${policy.table}.${hit.column}\n    ));\n-- Verify the intended direction first — this rewrite assumes the outer row was meant.`
+		fix: isRebaseManagedPolicy(snapshot, policy) ? managedPolicyFix(policy, `qualify every reference in the rule's condition so the binding is explicit — \`${hit.inner}.${hit.column}\` and \`${policy.table}.${hit.column}\` are different columns, and the bare name binds to the inner one`) : `-- Qualify every reference so the binding is explicit:\nALTER POLICY ${qi(policy.name)} ON ${qrel(policy.schema, policy.table)}\n    ${clause === "USING" ? "USING" : "WITH CHECK"} (EXISTS (\n        SELECT 1 FROM ${hit.inner}\n        WHERE ${hit.inner}.${hit.comparedTo.includes(".") ? hit.comparedTo.split(".").pop() : hit.comparedTo}\n            = ${policy.table}.${hit.column}\n    ));\n-- Verify the intended direction first — this rewrite assumes the outer row was meant.`
 	});
 }
 //#endregion
@@ -1618,6 +1944,7 @@ var CHECKS = [
 	rlsDisabled,
 	policyAlwaysTrue,
 	policyAnonymousTautology,
+	policyAuthenticatedTautology,
 	viewBypassesRls,
 	matviewBypassesRls,
 	anonymousWriteAllowed,
@@ -1672,6 +1999,225 @@ function sortFindings(snapshot, findings) {
 		return a.target.schema.localeCompare(b.target.schema) || (a.target.table ?? "").localeCompare(b.target.table ?? "") || a.id.localeCompare(b.id) || a.title.localeCompare(b.title);
 	});
 }
+/** Query parameters worth keeping in the redacted form: informative, never secret. */
+var SAFE_PARAMS = /* @__PURE__ */ new Set([
+	"sslmode",
+	"application_name",
+	"connect_timeout",
+	"target_session_attrs"
+]);
+function decode(value) {
+	try {
+		return decodeURIComponent(value);
+	} catch {
+		return value;
+	}
+}
+function splitHostPort(hostport) {
+	if (hostport.startsWith("[")) {
+		const close = hostport.indexOf("]");
+		if (close !== -1) {
+			const host = hostport.slice(0, close + 1);
+			const rest = hostport.slice(close + 1);
+			const port = rest.startsWith(":") ? Number.parseInt(rest.slice(1), 10) : NaN;
+			return {
+				host,
+				port: Number.isFinite(port) ? port : null
+			};
+		}
+	}
+	const colon = hostport.lastIndexOf(":");
+	if (colon === -1) return {
+		host: hostport,
+		port: null
+	};
+	const port = Number.parseInt(hostport.slice(colon + 1), 10);
+	if (!Number.isFinite(port)) return {
+		host: hostport,
+		port: null
+	};
+	return {
+		host: hostport.slice(0, colon),
+		port
+	};
+}
+/**
+* The libpq keyword/value form (`host=… dbname=…`) as a map of lowercased
+* keyword to unquoted value, or `null` when the string is not that form.
+*
+* Exported because `pg` cannot read this form at all: `pg-connection-string`
+* only understands URLs, so a `Client({ connectionString: "host=127.0.0.1
+* port=1 …" })` connects to the *default* host and reports a failure against an
+* endpoint nobody asked for. Whoever opens the connection has to translate
+* these keywords into `Client` options itself — see `connect()` in
+* `introspect.ts`.
+*/
+function parseKeywordConnectionString(raw) {
+	const trimmed = raw.trim();
+	if (trimmed.length === 0) return null;
+	if (/^[a-zA-Z][a-zA-Z0-9+.-]*:\/\//.test(trimmed)) return null;
+	const pairs = trimmed.match(/(\w+)\s*=\s*('(?:[^']|'')*'|[^\s]+)/g);
+	if (!pairs || pairs.length === 0) return null;
+	const map = /* @__PURE__ */ new Map();
+	for (const pair of pairs) {
+		const eq = pair.indexOf("=");
+		const key = pair.slice(0, eq).trim().toLowerCase();
+		let value = pair.slice(eq + 1).trim();
+		if (value.startsWith("'") && value.endsWith("'") && value.length >= 2) value = value.slice(1, -1).replace(/''/g, "'");
+		map.set(key, value);
+	}
+	if (!map.has("host") && !map.has("dbname") && !map.has("user")) return null;
+	return map;
+}
+function parseKeywordString(raw) {
+	const map = parseKeywordConnectionString(raw);
+	if (!map) return null;
+	const port = map.has("port") ? Number.parseInt(map.get("port"), 10) : NaN;
+	return {
+		scheme: "postgresql",
+		host: map.get("host") ?? "localhost",
+		port: Number.isFinite(port) ? port : null,
+		database: map.get("dbname") ?? "",
+		user: map.get("user") ?? null,
+		password: map.get("password") ?? null
+	};
+}
+/**
+* A hostname, an IPv4 literal, a bracketed IPv6 literal, or a Unix socket path.
+* Anything else means the split went wrong.
+*/
+var PLAUSIBLE_HOST = /^(\[[0-9A-Fa-f:.]+\]|[A-Za-z0-9._-]+|\/[^\s?#@]*)$/;
+/** A database name in a URL: no delimiters, because they were not encoded. */
+var PLAUSIBLE_DATABASE = /^[^\s:@?#/]*$/;
+/**
+* Split a connection string into its parts. Returns `null` when the input is
+* not recognisably a connection string — callers must treat that as "unknown",
+* never as "safe to print".
+*/
+function parseConnectionString(raw) {
+	const trimmed = raw.trim();
+	if (trimmed.length === 0) return null;
+	const schemeMatch = /^([a-zA-Z][a-zA-Z0-9+.-]*):\/\//.exec(trimmed);
+	if (!schemeMatch) return parseKeywordString(trimmed);
+	const scheme = schemeMatch[1];
+	const afterScheme = trimmed.slice(schemeMatch[0].length);
+	const pathStart = afterScheme.search(/[/?#]/);
+	const authority = pathStart === -1 ? afterScheme : afterScheme.slice(0, pathStart);
+	const remainder = pathStart === -1 ? "" : afterScheme.slice(pathStart);
+	let user = null;
+	let password = null;
+	let hostport = authority;
+	const at = authority.lastIndexOf("@");
+	if (at !== -1) {
+		const userinfo = authority.slice(0, at);
+		hostport = authority.slice(at + 1);
+		const colon = userinfo.indexOf(":");
+		if (colon === -1) user = decode(userinfo);
+		else {
+			user = decode(userinfo.slice(0, colon));
+			password = decode(userinfo.slice(colon + 1));
+		}
+	}
+	const { host, port } = splitHostPort(hostport);
+	let database = "";
+	if (remainder.startsWith("/")) {
+		const end = remainder.search(/[?#]/);
+		database = decode(end === -1 ? remainder.slice(1) : remainder.slice(1, end));
+	}
+	const queryStart = remainder.search(/[?#]/);
+	if (queryStart !== -1 && password === null) {
+		const params = new URLSearchParams(remainder.slice(queryStart + 1));
+		const fromQuery = params.get("password");
+		if (fromQuery) password = fromQuery;
+		if (user === null && params.get("user")) user = params.get("user");
+	}
+	const normalisedHost = host.length > 0 ? host : "localhost";
+	if (!PLAUSIBLE_HOST.test(normalisedHost) || !PLAUSIBLE_DATABASE.test(database)) return null;
+	return {
+		scheme,
+		host: normalisedHost,
+		port,
+		database,
+		user,
+		password
+	};
+}
+/** `host:port` if a port is known, otherwise just the host. Never a credential. */
+function formatEndpoint(target) {
+	if (!target) return "unknown host";
+	return target.port === null ? target.host : `${target.host}:${target.port}`;
+}
+/**
+* The display form of a connection string: scheme, host, port and database
+* kept; user and password replaced. Safe to print anywhere.
+*/
+function redactConnectionString(raw) {
+	const target = parseConnectionString(raw);
+	if (!target) return "<connection string>";
+	const credential = target.user !== null || target.password !== null ? `***:***@` : "";
+	const endpoint = formatEndpoint(target);
+	const database = target.database.length > 0 ? `/${target.database}` : "";
+	let query = "";
+	const queryStart = raw.indexOf("?");
+	if (queryStart !== -1) {
+		const kept = [];
+		for (const [key, value] of new URLSearchParams(raw.slice(queryStart + 1))) if (SAFE_PARAMS.has(key.toLowerCase())) kept.push(`${key}=${value}`);
+		if (kept.length > 0) query = `?${kept.join("&")}`;
+	}
+	return `${target.scheme}://${credential}${endpoint}${database}${query}`;
+}
+function escapeRegExp(value) {
+	return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+/**
+* Scrub credentials out of arbitrary text — driver error messages, stack
+* traces, anything we did not author. Two passes:
+*
+*   1. exact: the connection string we were given, and its password, wherever
+*      they appear, however they were quoted;
+*   2. generic: any `scheme://user:pass@host` shaped substring, which catches
+*      strings we were never told about (a `pg` error quoting `PGPASSWORD`, a
+*      nested cause carrying another URL).
+*
+* The generic pass is what makes this safe by default: forgetting to pass
+* `connectionString` degrades the redaction, it does not disable it.
+*/
+function redactSecrets(text, connectionString) {
+	let out = text;
+	if (connectionString && connectionString.trim().length > 0) {
+		const raw = connectionString.trim();
+		out = out.split(raw).join(redactConnectionString(raw));
+		const target = parseConnectionString(raw);
+		if (target?.user && target.user.length > 0) out = out.replace(new RegExp(`"${escapeRegExp(target.user)}"`, "g"), `"***"`);
+		if (target?.password && target.password.length >= 3) {
+			out = out.replace(new RegExp(escapeRegExp(target.password), "g"), "***");
+			const encoded = encodeURIComponent(target.password);
+			if (encoded !== target.password) out = out.replace(new RegExp(escapeRegExp(encoded), "g"), "***");
+		}
+	}
+	out = out.replace(/\b([a-zA-Z][a-zA-Z0-9+.-]*):\/\/([^\s"'<>]*?)@/g, (_match, scheme) => `${scheme}://***:***@`);
+	out = out.replace(/\bpassword\s*=\s*('(?:[^']|'')*'|"[^"]*"|\S+)/gi, `password=***`);
+	return out;
+}
+/**
+* Is this endpoint a local proxy or tunnel rather than the database itself?
+*
+* Matters for diagnosis: cloud-sql-proxy, an SSH -L forward and a local pooler
+* all accept the TCP connection and then hang up when *their* upstream auth
+* fails, which reaches the client as a bare ECONNRESET. Advice about TLS is
+* wrong there — the proxy terminates TLS itself, and the real cause is only in
+* its log.
+*
+* Takes the display form produced by `formatEndpoint`, so `host`, `host:port`
+* and `[::1]:5432` all work.
+*/
+function isLoopbackEndpoint(endpoint) {
+	const { host } = splitHostPort(endpoint.trim());
+	const bare = host.replace(/^\[|]$/g, "").toLowerCase();
+	if (bare === "localhost" || bare.endsWith(".localhost")) return true;
+	if (/^127\.\d{1,3}\.\d{1,3}\.\d{1,3}$/.test(bare)) return true;
+	return bare === "::1" || bare === "0:0:0:0:0:0:0:1";
+}
 //#endregion
 //#region src/introspect.ts
 /**
@@ -1694,6 +2240,23 @@ function sortFindings(snapshot, findings) {
 *   - Every optional query is guarded: a server that lacks a catalog degrades
 *     that one fact, not the whole scan.
 */
+/**
+* A `--role` that is not in `pg_roles`.
+*
+* Same reasoning as an unknown `--skip` id: a typo here does not widen the scan
+* and get noticed, it *narrows* it silently. `exposedRolesFor` drops the name,
+* every check that gates on a grant to an exposed role stops matching, and the
+* run prints "No findings" on a database nobody looked at properly. So it is an
+* error, not a warning.
+*/
+var UnknownRoleError = class extends Error {
+	roles;
+	constructor(roles) {
+		super(`Unknown role${roles.length === 1 ? "" : "s"}: ${roles.join(", ")}.`);
+		this.name = "UnknownRoleError";
+		this.roles = roles;
+	}
+};
 var SYSTEM_SCHEMAS = [
 	"pg_catalog",
 	"information_schema",
@@ -1803,15 +2366,74 @@ async function introspectWithDiagnostics(opts) {
 	}
 }
 /**
+* libpq keywords this tool can express as `pg` `Client` options.
+*
+* The list is an allowlist rather than a "map what we know and drop the rest",
+* because every keyword left out changes where the connection goes or how it is
+* verified: dropping `sslrootcert` would connect with weaker verification than
+* was asked for, and dropping `hostaddr` would connect to a different machine.
+* Silently doing either in a security scanner is worse than refusing.
+*/
+var SUPPORTED_KEYWORDS = /* @__PURE__ */ new Set([
+	"host",
+	"port",
+	"dbname",
+	"user",
+	"password",
+	"sslmode",
+	"application_name",
+	"connect_timeout",
+	"options"
+]);
+/**
+* The keywords in a libpq keyword string that this tool cannot honour, in the
+* order they were written. Empty for a URL, and empty for a keyword string it
+* can translate in full.
+*/
+function unsupportedConnectionKeywords(connectionString) {
+	const keywords = parseKeywordConnectionString(connectionString);
+	if (!keywords) return [];
+	return [...keywords.keys()].filter((keyword) => !SUPPORTED_KEYWORDS.has(keyword));
+}
+/**
+* `Client` options for a libpq keyword string. Throws on a keyword it cannot
+* honour. Exported for the test that pins the translation: getting `host` or
+* `port` wrong here sends a production scan somewhere nobody asked for, and the
+* failure would still be reported against the host the user typed.
+*/
+function clientConfigFromKeywords(keywords) {
+	const unsupported = [...keywords.keys()].filter((keyword) => !SUPPORTED_KEYWORDS.has(keyword));
+	if (unsupported.length > 0) throw new Error(`Unsupported connection keyword${unsupported.length === 1 ? "" : "s"}: ${unsupported.join(", ")}. Use a postgresql:// URL instead.`);
+	const port = keywords.has("port") ? Number.parseInt(keywords.get("port"), 10) : NaN;
+	const timeoutSeconds = keywords.has("connect_timeout") ? Number.parseInt(keywords.get("connect_timeout"), 10) : NaN;
+	const config = {
+		host: keywords.get("host") ?? "localhost",
+		database: keywords.get("dbname"),
+		user: keywords.get("user"),
+		password: keywords.get("password"),
+		application_name: keywords.get("application_name"),
+		options: keywords.get("options")
+	};
+	if (Number.isFinite(port)) config.port = port;
+	if (Number.isFinite(timeoutSeconds)) config.connectionTimeoutMillis = timeoutSeconds * 1e3;
+	return config;
+}
+/**
 * Connect, negotiating TLS the way libpq would.
 *
 * `pg` lets the connection string override an explicit `ssl` option, so the
 * `sslmode` parameter is read and removed before the attempts are built —
 * otherwise the retry would silently reuse the setting that just failed.
+*
+* `pg` also cannot read the libpq keyword form (`host=… dbname=…`) at all — it
+* would connect to the default host and then report the failure against the
+* host the user *did* name, which is the worst of both. So that form is
+* translated into explicit `Client` options here, or refused.
 */
 async function connect(connectionString) {
-	const sslmode = readParam(connectionString, "sslmode");
-	const cleaned = stripParam(connectionString, "sslmode");
+	const keywords = parseKeywordConnectionString(connectionString);
+	const sslmode = keywords ? keywords.get("sslmode")?.toLowerCase() : readParam(connectionString, "sslmode");
+	const base = keywords ? clientConfigFromKeywords(keywords) : { connectionString: stripParam(connectionString, "sslmode") };
 	let attempts;
 	switch (sslmode) {
 		case "disable":
@@ -1852,7 +2474,7 @@ async function connect(connectionString) {
 	let lastError;
 	for (const attempt of attempts) {
 		const client = new Client({
-			connectionString: cleaned,
+			...base,
 			ssl: attempt.ssl
 		});
 		try {
@@ -1919,19 +2541,23 @@ async function readSnapshot(client, opts, diagnostics) {
 	const allSchemas = (await db.query("schema list", "SELECT nspname FROM pg_namespace ORDER BY nspname")).map((r) => r.nspname);
 	const schemas = selectSchemas(allSchemas, opts.schemas, diagnostics);
 	const roles = await readRoles(db);
+	assertRolesExist(roles, opts.roles, diagnostics);
 	const relations = await readRelations(db, schemas);
 	const policies = await readPolicies(db, schemas);
 	const grants = await readGrants(db, schemas);
 	const views = await readViews(db, schemas, serverVersionNum, relations);
 	const foreignKeys = await readForeignKeys(db, schemas);
 	const routines = await readRoutines(db, schemas);
-	const exposedRoles = exposedRolesFor(roles, opts.roles);
+	const scannerIsPrivileged = isPrivileged(currentRole, server, roles, relations);
+	const connectingRole = !scannerIsPrivileged && currentRole !== "unknown" ? currentRole : void 0;
+	const exposedRoles = exposedRolesFor(roles, opts.roles, connectingRole);
+	diagnostics.scanningAsExposedRole = connectingRole && exposedRoles.includes(connectingRole) ? connectingRole : null;
 	diagnostics.unrecognizedGrantees = unrecognizedGranteesFor(grants, roles, relations, exposedRoles, currentRole);
 	return {
 		serverVersionNum,
 		serverVersion,
 		currentRole,
-		scannerIsPrivileged: isPrivileged(currentRole, server, roles, relations),
+		scannerIsPrivileged,
 		schemas,
 		exposedRoles,
 		platform: detectPlatform(allSchemas, roles),
@@ -2263,14 +2889,37 @@ function detectPlatform(allSchemas, roles) {
 * `service_role` is excluded on purpose. It exists, and it is in `roles`, but it
 * is the *trusted* bypass identity: treating it as exposed would flag every
 * table in every Supabase project as critical, which is both useless and wrong.
+*
+* `connecting` is the role the scan came in as, passed only when it is not
+* privileged — see the call site.
 */
-function exposedRolesFor(roles, explicit) {
+function exposedRolesFor(roles, explicit, connecting) {
 	const present = new Set(roles.map((r) => r.name));
-	const named = [...CANDIDATE_EXPOSED_ROLES, ...explicit ?? []];
+	const named = [
+		...CANDIDATE_EXPOSED_ROLES,
+		...explicit ?? [],
+		...connecting ? [connecting] : []
+	];
 	return ["PUBLIC", ...new Set(named.filter((r) => present.has(r)))];
 }
 /**
-* Roles that hold DML on a scanned table and are neither exposed nor trusted.
+* Refuse a `--role` that is not in `pg_roles`.
+*
+* Not a warning, for the reason spelled out on {@link UnknownRoleError}. The
+* one exception is a degraded `roles` read: with no catalogue to check against,
+* every name would look unknown, and turning a partial catalogue read into
+* "your flag is wrong" would send the reader after the wrong problem.
+*/
+function assertRolesExist(roles, requested, diagnostics) {
+	if (!requested || requested.length === 0) return;
+	if (diagnostics.degraded.some((entry) => entry.what === "roles")) return;
+	const present = new Set(roles.map((r) => r.name));
+	const unknown = [...new Set(requested.filter((role) => !present.has(role)))];
+	if (unknown.length > 0) throw new UnknownRoleError(unknown);
+}
+/**
+* Roles that can read or write a scanned table and are neither exposed nor
+* trusted.
 *
 * "Trusted" is deliberately generous — every role this can explain is one the
 * user does not have to think about. A grantee is explained when it is a
@@ -2279,8 +2928,15 @@ function exposedRolesFor(roles, explicit) {
 * connected as, or is platform bookkeeping (`pg_*`, `cloudsql*`, Supabase's
 * `service_role`, which is the documented trusted bypass).
 *
-* What is left is the interesting set: a named role, holding write privileges,
-* that this tool has no opinion about. It may be a service account nothing can
+* SELECT alone counts. It used to be filtered out as "a normal, deliberate
+* grant on a reference table", which reads the risk backwards: the finding this
+* whole tool exists for is `rls-disabled`, and what an RLS-disabled table
+* hands a role holding nothing but SELECT is every row in it. A read-only
+* reporting role reachable from the internet is the textbook leak, and the
+* caveat that exists to stop a false negative was skipping exactly that shape.
+*
+* What is left is the interesting set: a named role with data access that this
+* tool has no opinion about. It may be a service account nothing can
 * authenticate as — `rebase_user` is NOLOGIN by design — or it may be exactly
 * the role the API connects as. The scan cannot tell from the catalog, so it
 * names them and lets the reader decide.
@@ -2289,7 +2945,8 @@ function unrecognizedGranteesFor(grants, roles, relations, exposed, currentRole)
 	const exposedSet = new Set(exposed.map((r) => r.toLowerCase()));
 	const byName = new Map(roles.map((r) => [r.name.toLowerCase(), r]));
 	const owners = new Set(relations.map((r) => r.owner.toLowerCase()));
-	const writeable = /* @__PURE__ */ new Set([
+	const dataAccess = /* @__PURE__ */ new Set([
+		"SELECT",
 		"INSERT",
 		"UPDATE",
 		"DELETE"
@@ -2304,7 +2961,7 @@ function unrecognizedGranteesFor(grants, roles, relations, exposed, currentRole)
 		if (key.startsWith("pg_") || key.startsWith("cloudsql") || key === "service_role") continue;
 		const role = byName.get(key);
 		if (role?.superuser || role?.bypassRls) continue;
-		if (!grant.privileges.some((p) => writeable.has(p))) continue;
+		if (!grant.privileges.some((p) => dataAccess.has(p))) continue;
 		out.add(name);
 	}
 	return [...out].sort();
@@ -2312,228 +2969,6 @@ function unrecognizedGranteesFor(grants, roles, relations, exposed, currentRole)
 function isPublicName(name) {
 	return name.toUpperCase() === "PUBLIC";
 }
-/** Query parameters worth keeping in the redacted form: informative, never secret. */
-var SAFE_PARAMS = /* @__PURE__ */ new Set([
-	"sslmode",
-	"application_name",
-	"connect_timeout",
-	"target_session_attrs"
-]);
-function decode(value) {
-	try {
-		return decodeURIComponent(value);
-	} catch {
-		return value;
-	}
-}
-function splitHostPort(hostport) {
-	if (hostport.startsWith("[")) {
-		const close = hostport.indexOf("]");
-		if (close !== -1) {
-			const host = hostport.slice(0, close + 1);
-			const rest = hostport.slice(close + 1);
-			const port = rest.startsWith(":") ? Number.parseInt(rest.slice(1), 10) : NaN;
-			return {
-				host,
-				port: Number.isFinite(port) ? port : null
-			};
-		}
-	}
-	const colon = hostport.lastIndexOf(":");
-	if (colon === -1) return {
-		host: hostport,
-		port: null
-	};
-	const port = Number.parseInt(hostport.slice(colon + 1), 10);
-	if (!Number.isFinite(port)) return {
-		host: hostport,
-		port: null
-	};
-	return {
-		host: hostport.slice(0, colon),
-		port
-	};
-}
-function parseKeywordString(raw) {
-	const pairs = raw.match(/(\w+)\s*=\s*('(?:[^']|'')*'|[^\s]+)/g);
-	if (!pairs || pairs.length === 0) return null;
-	const map = /* @__PURE__ */ new Map();
-	for (const pair of pairs) {
-		const eq = pair.indexOf("=");
-		const key = pair.slice(0, eq).trim().toLowerCase();
-		let value = pair.slice(eq + 1).trim();
-		if (value.startsWith("'") && value.endsWith("'") && value.length >= 2) value = value.slice(1, -1).replace(/''/g, "'");
-		map.set(key, value);
-	}
-	if (!map.has("host") && !map.has("dbname") && !map.has("user")) return null;
-	const port = map.has("port") ? Number.parseInt(map.get("port"), 10) : NaN;
-	return {
-		scheme: "postgresql",
-		host: map.get("host") ?? "localhost",
-		port: Number.isFinite(port) ? port : null,
-		database: map.get("dbname") ?? "",
-		user: map.get("user") ?? null,
-		password: map.get("password") ?? null
-	};
-}
-/**
-* A hostname, an IPv4 literal, a bracketed IPv6 literal, or a Unix socket path.
-* Anything else means the split went wrong.
-*/
-var PLAUSIBLE_HOST = /^(\[[0-9A-Fa-f:.]+\]|[A-Za-z0-9._-]+|\/[^\s?#@]*)$/;
-/** A database name in a URL: no delimiters, because they were not encoded. */
-var PLAUSIBLE_DATABASE = /^[^\s:@?#/]*$/;
-/**
-* Split a connection string into its parts. Returns `null` when the input is
-* not recognisably a connection string — callers must treat that as "unknown",
-* never as "safe to print".
-*/
-function parseConnectionString(raw) {
-	const trimmed = raw.trim();
-	if (trimmed.length === 0) return null;
-	const schemeMatch = /^([a-zA-Z][a-zA-Z0-9+.-]*):\/\//.exec(trimmed);
-	if (!schemeMatch) return parseKeywordString(trimmed);
-	const scheme = schemeMatch[1];
-	const afterScheme = trimmed.slice(schemeMatch[0].length);
-	const pathStart = afterScheme.search(/[/?#]/);
-	const authority = pathStart === -1 ? afterScheme : afterScheme.slice(0, pathStart);
-	const remainder = pathStart === -1 ? "" : afterScheme.slice(pathStart);
-	let user = null;
-	let password = null;
-	let hostport = authority;
-	const at = authority.lastIndexOf("@");
-	if (at !== -1) {
-		const userinfo = authority.slice(0, at);
-		hostport = authority.slice(at + 1);
-		const colon = userinfo.indexOf(":");
-		if (colon === -1) user = decode(userinfo);
-		else {
-			user = decode(userinfo.slice(0, colon));
-			password = decode(userinfo.slice(colon + 1));
-		}
-	}
-	const { host, port } = splitHostPort(hostport);
-	let database = "";
-	if (remainder.startsWith("/")) {
-		const end = remainder.search(/[?#]/);
-		database = decode(end === -1 ? remainder.slice(1) : remainder.slice(1, end));
-	}
-	const queryStart = remainder.search(/[?#]/);
-	if (queryStart !== -1 && password === null) {
-		const params = new URLSearchParams(remainder.slice(queryStart + 1));
-		const fromQuery = params.get("password");
-		if (fromQuery) password = fromQuery;
-		if (user === null && params.get("user")) user = params.get("user");
-	}
-	const normalisedHost = host.length > 0 ? host : "localhost";
-	if (!PLAUSIBLE_HOST.test(normalisedHost) || !PLAUSIBLE_DATABASE.test(database)) return null;
-	return {
-		scheme,
-		host: normalisedHost,
-		port,
-		database,
-		user,
-		password
-	};
-}
-/** `host:port` if a port is known, otherwise just the host. Never a credential. */
-function formatEndpoint(target) {
-	if (!target) return "unknown host";
-	return target.port === null ? target.host : `${target.host}:${target.port}`;
-}
-/**
-* The display form of a connection string: scheme, host, port and database
-* kept; user and password replaced. Safe to print anywhere.
-*/
-function redactConnectionString(raw) {
-	const target = parseConnectionString(raw);
-	if (!target) return "<connection string>";
-	const credential = target.user !== null || target.password !== null ? `***:***@` : "";
-	const endpoint = formatEndpoint(target);
-	const database = target.database.length > 0 ? `/${target.database}` : "";
-	let query = "";
-	const queryStart = raw.indexOf("?");
-	if (queryStart !== -1) {
-		const kept = [];
-		for (const [key, value] of new URLSearchParams(raw.slice(queryStart + 1))) if (SAFE_PARAMS.has(key.toLowerCase())) kept.push(`${key}=${value}`);
-		if (kept.length > 0) query = `?${kept.join("&")}`;
-	}
-	return `${target.scheme}://${credential}${endpoint}${database}${query}`;
-}
-function escapeRegExp(value) {
-	return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-}
-/**
-* Scrub credentials out of arbitrary text — driver error messages, stack
-* traces, anything we did not author. Two passes:
-*
-*   1. exact: the connection string we were given, and its password, wherever
-*      they appear, however they were quoted;
-*   2. generic: any `scheme://user:pass@host` shaped substring, which catches
-*      strings we were never told about (a `pg` error quoting `PGPASSWORD`, a
-*      nested cause carrying another URL).
-*
-* The generic pass is what makes this safe by default: forgetting to pass
-* `connectionString` degrades the redaction, it does not disable it.
-*/
-function redactSecrets(text, connectionString) {
-	let out = text;
-	if (connectionString && connectionString.trim().length > 0) {
-		const raw = connectionString.trim();
-		out = out.split(raw).join(redactConnectionString(raw));
-		const target = parseConnectionString(raw);
-		if (target?.user && target.user.length > 0) out = out.replace(new RegExp(`"${escapeRegExp(target.user)}"`, "g"), `"***"`);
-		if (target?.password && target.password.length >= 3) {
-			out = out.replace(new RegExp(escapeRegExp(target.password), "g"), "***");
-			const encoded = encodeURIComponent(target.password);
-			if (encoded !== target.password) out = out.replace(new RegExp(escapeRegExp(encoded), "g"), "***");
-		}
-	}
-	out = out.replace(/\b([a-zA-Z][a-zA-Z0-9+.-]*):\/\/([^\s"'<>]*?)@/g, (_match, scheme) => `${scheme}://***:***@`);
-	out = out.replace(/\bpassword\s*=\s*('(?:[^']|'')*'|"[^"]*"|\S+)/gi, `password=***`);
-	return out;
-}
-/**
-* Is this endpoint a local proxy or tunnel rather than the database itself?
-*
-* Matters for diagnosis: cloud-sql-proxy, an SSH -L forward and a local pooler
-* all accept the TCP connection and then hang up when *their* upstream auth
-* fails, which reaches the client as a bare ECONNRESET. Advice about TLS is
-* wrong there — the proxy terminates TLS itself, and the real cause is only in
-* its log.
-*
-* Takes the display form produced by `formatEndpoint`, so `host`, `host:port`
-* and `[::1]:5432` all work.
-*/
-function isLoopbackEndpoint(endpoint) {
-	const { host } = splitHostPort(endpoint.trim());
-	const bare = host.replace(/^\[|]$/g, "").toLowerCase();
-	if (bare === "localhost" || bare.endsWith(".localhost")) return true;
-	if (/^127\.\d{1,3}\.\d{1,3}\.\d{1,3}$/.test(bare)) return true;
-	return bare === "::1" || bare === "0:0:0:0:0:0:0:1";
-}
-//#endregion
-//#region src/types.ts
-/**
-* The contract between the three layers of `rls-check`:
-*
-*   introspect.ts  — reads the catalogs into a {@link DbSnapshot}. Talks to Postgres.
-*   checks/*.ts    — pure functions, snapshot in, {@link Finding}s out. No I/O.
-*   report.ts      — Findings to text or JSON. No knowledge of Postgres.
-*
-* Checks being pure is the point: every one of them is unit-testable against a
-* hand-written snapshot, so the test suite does not need a live database to
-* cover the interesting cases (it has a Docker-backed suite too, for the
-* introspection layer, which is the only part that can lie).
-*/
-/** Ordered least → most severe; the CLI's `--fail-on` compares by index. */
-var SEVERITIES = [
-	"info",
-	"low",
-	"medium",
-	"high",
-	"critical"
-];
 //#endregion
 //#region src/report.ts
 /** Higher is worse. `info` = 0 … `critical` = 4. */
@@ -2675,6 +3110,11 @@ function renderReport(result, options) {
 		out.push(...renderPrivilegeCaveat$1(style, width));
 		out.push("");
 	}
+	const scanningAs = result.diagnostics?.scanningAsExposedRole;
+	if (scanningAs) {
+		out.push(...renderConnectingRoleNote(scanningAs, style, width));
+		out.push("");
+	}
 	const degraded = result.diagnostics?.degraded ?? [];
 	if (degraded.length > 0) {
 		out.push(...renderDegradedCaveat$1(degraded, style, width));
@@ -2707,10 +3147,12 @@ function renderHeader(result, style, width, options) {
 	out.push("");
 	const endpoint = options.endpoint ?? result.database.host;
 	const serverVersion = /^[\d.]/.test(result.serverVersion.trim()) ? `PostgreSQL ${result.serverVersion}` : result.serverVersion;
+	const exposed = result.exposedRoles ?? [];
 	const rows = [
 		["Database", `${endpoint}/${result.database.name}`],
 		["Server", serverVersion],
 		["Platform", PLATFORM_LABEL$1[result.platform]],
+		["Exposed", `${exposed.length > 0 ? exposed.join(", ") : "PUBLIC"} (add yours with --role)`],
 		["Scanned", [
 			`${result.stats.schemas} ${plural$1(result.stats.schemas, "schema", "schemas")}`,
 			`${result.stats.tables} ${plural$1(result.stats.tables, "table", "tables")}`,
@@ -2730,6 +3172,22 @@ function renderPrivilegeCaveat$1(style, width) {
 	return out;
 }
 /**
+* The scan connected as a role row-level security constrains, so that role was
+* treated as exposed.
+*
+* The counterpart to {@link renderPrivilegeCaveat}: one says "nothing below
+* describes this connection", the other says "this connection is one of the
+* things below". Both are disclosures about what the exposed set contains,
+* which is the only reason any of the findings say what they say.
+*/
+function renderConnectingRoleNote(role, style, width) {
+	const body = wrap(`This scan connected as "${role}", which row-level security does constrain — no superuser, no BYPASSRLS, no ownership of the scanned tables. It has therefore been treated as a role an untrusted caller can arrive as, and the findings below include what it reaches. Scanning the same database as a privileged role will report a different set.`, width - 8);
+	const out = [];
+	out.push(`${style.yellow("Note")}  ${body[0] ?? ""}`);
+	for (const line of body.slice(1)) out.push(`      ${line}`);
+	return out;
+}
+/**
 * The caveat that keeps a false negative from reading as a pass.
 *
 * Deliberately not a finding: the scan has no evidence that any of these roles
@@ -2740,7 +3198,7 @@ function renderPrivilegeCaveat$1(style, width) {
 function renderUnrecognizedRolesCaveat(roles, style, width) {
 	const shown = roles.slice(0, 6);
 	const rest = roles.length - shown.length;
-	const body = wrap(`${shown.map((r) => `"${r}"`).join(", ") + (rest > 0 ? `, and ${rest} more` : "")} ${plural$1(roles.length, "holds", "hold")} write privileges here, and this scan does not know whether requests arrive as ${plural$1(roles.length, "it", "them")}. The checks only report a table as exposed when an exposed role can reach it, so anything served through ${plural$1(roles.length, "this role", "these roles")} was NOT assessed. If your application connects as one of them, re-run naming it — for example: --role ${shown[0] ?? "app_user"}`, width - 8);
+	const body = wrap(`${shown.map((r) => `"${r}"`).join(", ") + (rest > 0 ? `, and ${rest} more` : "")} can read or write scanned tables here, and this scan does not know whether requests arrive as ${plural$1(roles.length, "it", "them")}. The checks only report a table as exposed when an exposed role can reach it, so anything served through ${plural$1(roles.length, "this role", "these roles")} was NOT assessed. If your application connects as one of them, re-run naming it — for example: --role ${shown[0] ?? "app_user"}`, width - 8);
 	const out = [];
 	out.push(`${style.yellow("Note")}  ${body[0] ?? ""}`);
 	for (const line of body.slice(1)) out.push(`      ${line}`);
@@ -3228,6 +3686,7 @@ function buildScanResult(snapshot, findings, meta) {
 		serverVersion: snapshot.serverVersion,
 		platform: snapshot.platform,
 		scannerIsPrivileged: snapshot.scannerIsPrivileged,
+		exposedRoles: snapshot.exposedRoles,
 		stats: {
 			schemas: snapshot.schemas.length,
 			tables: tables.length,
@@ -3509,7 +3968,7 @@ function explainError(error, context) {
 		case "SELF_SIGNED_CERT_IN_CHAIN":
 		case "UNABLE_TO_VERIFY_LEAF_SIGNATURE":
 		case "ERR_TLS_CERT_ALTNAME_INVALID": return friendly(`The TLS certificate presented by ${at} could not be verified.`, "Append ?sslmode=no-verify to connect without verifying it, or point sslrootcert at your provider's CA bundle if you would rather keep verification on.");
-		case "28P01": return friendly(`Password authentication failed on ${at}.`, "Check the password. If it contains @ : / ? or #, it has to be percent-encoded inside a URL — that is the single most common cause of this error.");
+		case "28P01": return friendly(`Password authentication failed on ${at}.`, "Check the password. If it contains / ? or #, it has to be percent-encoded inside a URL — that is the single most common cause of this error. An @ or a : needs no encoding: the userinfo is split at the last @ and the user at the first :.");
 		case "28000": return friendly(`${at} refused the connection for this role.`, "Either the role does not exist, or pg_hba.conf has no rule matching this host, user and database combination.");
 		case "3D000": return friendly("That database does not exist on the server.", "The database name is the last path segment of the connection string. On Supabase it is usually `postgres`.");
 		case "42501": return friendly("The connected role is not allowed to read the catalogs this scan needs.", "Run it as the database owner or another role that can read pg_policies and pg_class. The scan itself only issues SELECTs.");
@@ -3542,11 +4001,16 @@ function helpText(version) {
 	return `rls-check ${version} — audit Row-Level Security on any PostgreSQL database.
 
 Usage
-  npx @rebasepro/rls-check [connection-string] [options]
+  DATABASE_URL="postgresql://user:pass@host:5432/db" npx @rebasepro/rls-check
 
 The connection string is taken from, in order: the argument, $DATABASE_URL,
 $POSTGRES_URL, then DATABASE_URL in a .env file in the current directory.
 
+Prefer the environment. A connection string passed as an argument is echoed back
+by npm before this program starts, and is written to your shell history — both
+with the password in it, and neither is something rls-check can redact after the
+fact. Its own output redacts the password everywhere.
+
 Options
   --json                 Machine-readable ScanResult on stdout, and nothing else.
   --html <path>          Also write a self-contained HTML report to <path>. One file,
@@ -3575,7 +4039,8 @@ Exit codes
   2  The scan did not run: bad arguments, connection refused, auth failed, timeout.
 
 Examples
-  npx @rebasepro/rls-check "postgresql://user:pass@db.abcdef.supabase.co:5432/postgres"
+  DATABASE_URL="postgresql://user:pass@db.abcdef.supabase.co:5432/postgres" \\
+      npx @rebasepro/rls-check
   npx @rebasepro/rls-check --schema public --schema billing --fail-on medium
   npx @rebasepro/rls-check --json > rls-report.json
   npx @rebasepro/rls-check --html rls-report.html
@@ -3587,10 +4052,12 @@ and sends nothing anywhere.
 function usageText() {
 	return `rls-check needs a PostgreSQL connection string.
 
-  npx @rebasepro/rls-check "postgresql://user:password@host:5432/database"
+  DATABASE_URL="postgresql://user:password@host:5432/database" npx @rebasepro/rls-check
 
-Or set DATABASE_URL (or POSTGRES_URL) in the environment, or put DATABASE_URL in
-a .env file in this directory.
+Or put DATABASE_URL in a .env file in this directory, or set POSTGRES_URL. It
+also accepts the string as an argument, but npm echoes the command line before
+this program starts and your shell records it, so the password ends up in two
+places rls-check cannot reach.
 
 It is read-only — it reads the system catalogs and writes nothing. Run with
 --help for all options.
@@ -3686,7 +4153,15 @@ async function runCli(argv, io = defaultIo()) {
 		if (!target) {
 			io.stderr(formatFriendlyError({
 				headline: "That does not look like a PostgreSQL connection string.",
-				hint: "Expected postgresql://user:password@host:5432/database, or a libpq keyword string such as host=… dbname=…. If the password contains @ : / ? or #, percent-encode it — otherwise the URL is ambiguous and neither this tool nor libpq can tell where the credential ends."
+				hint: "Expected postgresql://user:password@host:5432/database, or a libpq keyword string carrying at least one of host= dbname= user= (port, password, sslmode, application_name, connect_timeout and options are honoured too). A password containing / ? or # is the usual cause: those end the authority, so the split lands inside the credential and neither this tool nor libpq can tell where it ends — percent-encode them. An @ or a : inside a password is fine, and needs no encoding."
+			}, color));
+			return 2;
+		}
+		const unsupported = unsupportedConnectionKeywords(connectionString);
+		if (unsupported.length > 0) {
+			io.stderr(formatFriendlyError({
+				headline: `This connection string uses ${unsupported.length === 1 ? "a keyword" : "keywords"} the scan cannot honour: ${unsupported.join(", ")}.`,
+				hint: "Rewrite it as a URL — postgresql://user:password@host:5432/database?sslmode=require. Connecting with those keywords dropped would send the scan somewhere you did not ask for, or verify TLS less strictly than you asked for."
 			}, color));
 			return 2;
 		}
@@ -3706,6 +4181,13 @@ async function runCli(argv, io = defaultIo()) {
 				statementTimeoutMs: options.timeoutMs
 			});
 		} catch (error) {
+			if (error instanceof UnknownRoleError) {
+				io.stderr(formatFriendlyError({
+					headline: `No such role on this database: ${error.roles.join(", ")}.`,
+					hint: "Check the spelling against `SELECT rolname FROM pg_roles`. This is an error rather than a warning for the same reason an unknown --skip id is: a name that matches nothing silently narrows the scan, and the run then prints a clean report of a database nobody looked at."
+				}, color));
+				return 2;
+			}
 			io.stderr(formatFriendlyError(explainError(error, {
 				endpoint,
 				timeoutMs: options.timeoutMs,