easyvibegate 0.6.0 → 0.6.8

package/README.md

@@ -106,6 +106,10 @@ jobs:
 
 Плюс: `postgres://app:app@localhost` в docker-compose / CI — дефолтный логин локального контейнера, не секрет; `tracking_token` и `pagination_token` из кэша API — не секреты; папки `cache/`, `tmp/` не сканируются.
 
+Секрет в gitignored-файле, который **не** `.env` (например, пароль от прода в `.claude/settings.local.json`), — предупреждение: через git не утечёт, но лежит не там. Папка `easyvibegate-report/` сама пишет себе `.gitignore` — отчёт содержит префиксы секретов и карту эндпоинтов, коммитить его нельзя.
+
+Статическая проверка RLS видит только `CREATE TABLE` из миграций в репозитории. Таблицы, созданные из дашборда или из другого репо, перечисляет только живая проверка — если отказаться от неё, в отчёте будет часть картины, и он об этом скажет.
+
 Оценка — это отметка, а не счётчик: после пяти предупреждений балл перестаёт падать (число всё равно показано), критичные могут обнулить его по-прежнему.
 
 ## Оценка и статусы

package/dist/cli/index.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { existsSync, mkdirSync, rmSync, statSync, writeFileSync } from 'node:fs';
+import { existsSync, mkdirSync, readFileSync, readdirSync, rmSync, statSync, writeFileSync } from 'node:fs';
 import { join, resolve } from 'node:path';
 import { createInterface } from 'node:readline';
 import { planTargets, runFlow } from '../orchestrator/flow.js';
@@ -262,6 +262,23 @@ async function main() {
     // Reports land next to the scanned project by default, so scanning several
     // projects from one shell never overwrites another project's report.
     const outDir = args.output !== undefined ? resolve(args.output) : join(root, 'easyvibegate-report');
+    // Excluding outDir from the scan only makes sense when something is
+    // actually going to be written there. With --no-report (format 'none'),
+    // nothing is ever written to it — so a `--no-report --output <project>/src`
+    // run must not exclude real source just because it shares a path with an
+    // output directory nothing will use.
+    const excludeOutDir = args.format !== 'none' ? [outDir] : [];
+    // The report directory gets its OWN `.gitignore` (see prepareOutputDir) and
+    // has its stale report files deleted on every run. Both are safe for a
+    // directory that exists only to hold reports — neither is safe for the
+    // scanned project itself: `--output .` from the project root would replace
+    // the project's real .gitignore with a bare `*`, silently un-tracking the
+    // whole repo.
+    if (args.output !== undefined && outDir === root) {
+        process.stderr.write(`easyvibegate: --output must not be the scanned project itself (${root}) — pick a subdirectory, e.g. --output ${join(root, 'easyvibegate-report')}
+`);
+        process.exit(2);
+    }
     // Use the friendly wizard when a human runs it in a terminal without
     // automation flags; --wizard forces it. Either way the pipeline below is shared.
     // --ci is a non-interactive contract: never ask questions there.
@@ -281,7 +298,7 @@ async function main() {
     let result;
     if (useWizard) {
         result = await runWizard({
-            excludeAbs: [outDir],
+            excludeAbs: excludeOutDir,
             path: args.path,
             config: args.config,
             lang,
@@ -309,7 +326,7 @@ async function main() {
         };
         // Same contract as the wizard: plan the concrete targets once, ask about
         // exactly those, execute exactly those.
-        const staticResult = await scanStatic(root, { configPath: args.config, excludeAbs: [outDir] });
+        const staticResult = await scanStatic(root, { configPath: args.config, excludeAbs: excludeOutDir });
         const plan = planTargets(staticResult.files, loadConfig(root, args.config), {
             appUrl: args.appUrl,
             supabaseUrl: args.supabaseUrl,
@@ -362,12 +379,33 @@ async function main() {
     // Same contract in every mode: 2 critical, 1 warning, 3 incomplete, 0 clean.
     process.exit(exitCodeFor(summary));
 }
+// Written verbatim (never partially, never appended-to) so an exact match on
+// disk is proof WE created this directory, not the user re-pointing --output
+// at a folder of their own. Checking "does outDir === project root" only was
+// not enough: `--output docs` on a real docs/ folder replaced its real
+// .gitignore (losing rules like `drafts/`) and deleted a real docs/report.md.
+const OUTPUT_DIR_MARKER = '# Written by EasyVibeGate: this report can contain secret prefixes and hosts. Never commit it.\n*\n';
 /** Create the report dir and clear our own stale files, or explain why we cannot. */
 function prepareOutputDir(dir) {
     try {
-        if (existsSync(dir) && !statSync(dir).isDirectory())
+        const existed = existsSync(dir);
+        if (existed && !statSync(dir).isDirectory())
             return 'exists and is not a directory';
+        if (existed) {
+            const ownsIt = existsSync(join(dir, '.gitignore')) && readFileSync(join(dir, '.gitignore'), 'utf8') === OUTPUT_DIR_MARKER;
+            if (!ownsIt && readdirSync(dir).length > 0) {
+                return 'already exists, is not empty, and was not created by a previous EasyVibeGate run — refusing to overwrite its .gitignore or delete files in it; point --output at an empty or dedicated directory';
+            }
+        }
         mkdirSync(dir, { recursive: true });
+        // The report names secret prefixes, database hosts and every endpoint —
+        // exactly what must not be committed. A `.gitignore` containing `*` inside
+        // the directory makes git ignore it wherever the project's own .gitignore
+        // stands (the trick node_modules-style caches use); the user's files are
+        // never edited. Rewritten every run so a stray edit cannot un-ignore it —
+        // safe now because we only ever reach this line for a directory that was
+        // either empty or already marked as ours.
+        writeFileSync(join(dir, '.gitignore'), OUTPUT_DIR_MARKER, 'utf8');
         // Old report.md next to a fresh report.json told two different stories.
         for (const name of ['report.md', 'report.json', 'ai-fix-prompt.md']) {
             const p = join(dir, name);

package/dist/engine/checkers/backend/firebase.js

@@ -1,5 +1,8 @@
 import { classifyBody, request, sleep } from '../../net/http.js';
-import { looksLikePlaceholder } from '../../util/text.js';
+import { DNS_LABEL, looksLikePlaceholder } from '../../util/text.js';
+const FIREBASEIO_URL = new RegExp(`https://${DNS_LABEL}(?:-default-rtdb)?\\.firebaseio\\.com`);
+const FIREBASEAPP_DOMAIN = new RegExp(`(${DNS_LABEL})\\.firebaseapp\\.com`);
+const FIREBASEDATABASE_APP = new RegExp(`^${DNS_LABEL}\\.firebasedatabase\\.app$`);
 const COMMON_COLLECTIONS = [
     'users', 'user', 'profiles', 'accounts', 'messages', 'chats', 'posts',
     'orders', 'payments', 'products', 'items', 'settings', 'admin', 'config',
@@ -11,13 +14,16 @@ export function discoverFirebase(all) {
     let projectId;
     let databaseURL;
     let storageBucket;
+    // This loop runs against every project file's raw content, including large
+    // ones — see `DNS_LABEL` in util/text.ts for why the two host regexes below
+    // are bounded instead of `[a-z0-9-]+`.
     for (const f of files) {
         projectId ??= f.content.match(/projectId\s*:\s*["']([^"']+)["']/)?.[1];
         databaseURL ??= f.content.match(/databaseURL\s*:\s*["']([^"']+)["']/)?.[1]
-            ?? f.content.match(/https:\/\/[a-z0-9-]+(?:-default-rtdb)?\.firebaseio\.com/)?.[0];
+            ?? f.content.match(FIREBASEIO_URL)?.[0];
         storageBucket ??= f.content.match(/storageBucket\s*:\s*["']([^"']+)["']/)?.[1];
         if (!projectId) {
-            const dom = f.content.match(/([a-z0-9-]+)\.firebaseapp\.com/)?.[1];
+            const dom = f.content.match(FIREBASEAPP_DOMAIN)?.[1];
             if (dom)
                 projectId = dom;
         }
@@ -37,7 +43,11 @@ function isOwnRtdbHost(host, projectId) {
     const regional = `${p}-default-rtdb.`; // <project>-default-rtdb.<region>.firebasedatabase.app
     return host === `${p}.firebaseio.com`
         || host === `${p}-default-rtdb.firebaseio.com`
-        || (host.startsWith(regional) && /^[a-z0-9-]+\.firebasedatabase\.app$/.test(host.slice(regional.length)))
+        // `host` here is already `new URL(...).hostname` (bounded by the caller,
+        // ownDatabaseURL below), not raw file content — but it's bounded via the
+        // shared constant anyway rather than `+`, so this stays safe even if that
+        // ever changes and nothing here looks unlike its two siblings above.
+        || (host.startsWith(regional) && FIREBASEDATABASE_APP.test(host.slice(regional.length)))
         || host === `${p}.firebaseapp.com`;
 }
 /**

package/dist/engine/checkers/backend/supabase.js

@@ -21,7 +21,11 @@ export function classifyKey(key) {
         return 'jwt-service';
     return 'unknown';
 }
-const BARE_URL = /https:\/\/[a-z0-9]{16,}\.supabase\.co/;
+// Bounded for the same reason as the shared `DNS_LABEL` in util/text.ts (a
+// quadratic-time regex on raw file content) — but a Supabase project ref is
+// its own format (no hyphens, {16,63} not {1,63}), so this stays a literal
+// rather than reusing that constant.
+const BARE_URL = /https:\/\/[a-z0-9]{16,63}\.supabase\.co/;
 const BARE_PUBLISHABLE = /\bsb_publishable_[A-Za-z0-9_-]{10,}\b/;
 const BARE_JWT = /\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\b/g;
 function isPublicKey(key) {

package/dist/engine/checkers/static/client-exposure.js

@@ -1,10 +1,20 @@
 import { lineAt, looksLikePlaceholder, redact } from '../../util/text.js';
+import { maskCode } from '../../util/mask.js';
 import { classifyKey } from '../backend/supabase.js';
 // Public env prefixes are inlined into the browser bundle by the bundler.
 const PUBLIC_PREFIX = '(?:NEXT_PUBLIC_|VITE_|REACT_APP_|EXPO_PUBLIC_|GATSBY_|PUBLIC_)';
 // Every public-prefixed assignment; what it carries is decided by the VALUE
-// first and the NAME second (below).
-const PUBLIC_ASSIGN = new RegExp(`\\b(${PUBLIC_PREFIX}[A-Z0-9_]*)\\s*[:=]\\s*["']?([^"'\\s]{6,})`, 'gi');
+// first and the NAME second (below). The name gets an optional closing quote
+// before the `:`/`=` — a JSON/object literal's `"NEXT_PUBLIC_KEY": "value"`
+// otherwise never matched at all, since nothing after the bare name expected
+// that stray `"`. The gap between `:`/`=` and the value is same-line
+// whitespace only (`[ \t]*`, not `\s*`) — an EMPTY-valued var followed by
+// blank/commented lines otherwise let the value group skip straight past
+// them onto the NEXT var's name, reporting that name as a leaked secret
+// value. Once comments started getting masked to blank space (below), a
+// `.env.example`'s usual "KEY=\n\n# comment\nNEXT_KEY=" shape hit this on
+// real projects.
+const PUBLIC_ASSIGN = new RegExp(`\\b(${PUBLIC_PREFIX}[A-Z0-9_]*)["']?\\s*[:=][ \\t]*["']?([^"'\\s]{6,})`, 'gi');
 // A public var whose NAME implies a real secret (not an anon/publishable key).
 const SECRET_NAME = /(SERVICE_ROLE|SECRET|PRIVATE|PASSWORD|PASSWD|TOKEN|CREDENTIAL|API_KEY|ACCESS_KEY)/i;
 // Value shapes that are server secrets no matter what the variable is called.
@@ -40,7 +50,10 @@ export const clientExposureChecker = {
         const advised = new Set();
         for (const file of ctx.files) {
             const { content, rel } = file;
-            for (const m of content.matchAll(PUBLIC_ASSIGN)) {
+            // Commented-out code is not a live exposure; masking preserves length
+            // and newlines so match offsets/line numbers still point at the source.
+            const scan = maskCode(content, { file: rel });
+            for (const m of scan.matchAll(PUBLIC_ASSIGN)) {
                 const name = m[1] ?? '';
                 const value = m[2] ?? '';
                 if (looksLikePlaceholder(value))

package/dist/engine/checkers/static/config-risks.js

@@ -37,7 +37,13 @@ const RULES = [
         // inside one string literal — so prose mentioning "insert" won't match.
         // Quantifiers are length-bounded ({0,200}) to prevent catastrophic
         // backtracking (ReDoS) on very long / minified lines.
-        re: /`\s*(?:SELECT|INSERT|UPDATE|DELETE)\b[^`]{0,200}\b(?:FROM|INTO|WHERE|VALUES|SET|JOIN)\b[^`]{0,200}\$\{|f["']\s*(?:SELECT|INSERT|UPDATE|DELETE)\b[^"'\n]{0,200}\b(?:FROM|INTO|WHERE|VALUES|SET|JOIN)\b[^"'\n]{0,200}\{/gi,
+        //
+        // The f-string branch tracks its OWN opening quote via a backreference
+        // (`(?:(?!\1)[^\n])` — any char that isn't a newline or that quote) rather
+        // than excluding both quote characters outright: `f"SELECT … WHERE name =
+        // '{x}'"` nests a single-quoted SQL string value inside a double-quoted
+        // f-string, and excluding `'` too made the whole pattern never match.
+        re: /`\s*(?:SELECT|INSERT|UPDATE|DELETE)\b[^`]{0,200}\b(?:FROM|INTO|WHERE|VALUES|SET|JOIN)\b[^`]{0,200}\$\{|f(["'])\s*(?:SELECT|INSERT|UPDATE|DELETE)\b(?:(?!\1)[^\n]){0,200}\b(?:FROM|INTO|WHERE|VALUES|SET|JOIN)\b(?:(?!\1)[^\n]){0,200}\{/gi,
         severity: 'warning',
         detail: 'Interpolating values into SQL invites SQL injection.',
         fix: 'Use parameterized queries / prepared statements instead of string interpolation.',
@@ -73,7 +79,11 @@ function isParameterizedTemplate(scan, backtickAt) {
  * from request data, so it is reported as info, not as an injection. About half
  * of the real-world hits were structural.
  */
-const VALUE_POSITION = /(=|<>|!=|<=|>=|<|>|\bLIKE|\bILIKE|\bIN\s*\(|\bVALUES\s*\([^)]*|\bBETWEEN|\bAND|\bOR|\bLIMIT|\bOFFSET|\bTHEN|\bELSE)\s*$/i;
+// A trailing `["']?` handles the equally common quoted-value shape
+// (`name = '${name}'`, `WHERE id = "${id}"`) — the SQL literal's own quote
+// sits directly before the hole, between the operator and `${`/`{`, and
+// without it that shape read as unquoted structure, not a value.
+const VALUE_POSITION = /(=|<>|!=|<=|>=|<|>|\bLIKE|\bILIKE|\bIN\s*\(|\bVALUES\s*\([^)]*|\bBETWEEN|\bAND|\bOR|\bLIMIT|\bOFFSET|\bTHEN|\bELSE)\s*["']?\s*$/i;
 const PLACEHOLDER_EXPR = /^\s*(?:\w+\.)?(placeholders?|params?|marks|questions|qs|values|binds?)\b/i;
 function onlyStructuralInterpolation(scan, at) {
     // The literal: from the opening delimiter to its close (bounded).

package/dist/engine/checkers/static/rls-migrations.js

@@ -592,27 +592,33 @@ export const rlsMigrationsChecker = {
     level: 0,
     run(ctx) {
         const sqlFiles = ctx.files.filter((f) => f.ext === '.sql').sort((a, b) => a.rel.localeCompare(b.rel));
-        if (sqlFiles.length === 0)
-            return [];
         // RLS is a PostgreSQL feature. The engine is decided per FILE, not per
         // project: a monorepo can hold a Postgres schema next to a Cloudflare D1
         // (SQLite) one, and a SQLite schema must never be told to enable RLS — that
         // engine has no such thing. A real D1 project once got five "critical" RLS
         // findings and a 0/100 because the old gate only knew MySQL's
         // `auto_increment` (with the underscore) and never heard of D1/wrangler.
-        const pkg = ctx.files.find((f) => f.rel === 'package.json')?.content ?? '';
-        const reqs = ctx.files.find((f) => f.rel === 'requirements.txt')?.content ?? '';
-        const codeAndEnv = ctx.files
-            .filter((f) => !/\.(md|mdx|txt|rst|sql)$/i.test(f.rel))
-            .map((f) => f.content)
-            .join('\n');
+        // A monorepo's dependencies often live in apps/*/package.json, not the
+        // workspace root. Reading only the root file missed a D1/SQLite worker's
+        // `wrangler`/`better-sqlite3` signal whenever the SQL itself carried no
+        // dialect marker either, and defaulted it to Postgres — a phantom critical
+        // on a database that has no RLS to enable.
+        const pkg = ctx.files.filter((f) => f.rel.endsWith('package.json')).map((f) => f.content).join('\n');
+        const reqs = ctx.files.filter((f) => f.rel === 'requirements.txt' || f.rel.endsWith('/requirements.txt')).map((f) => f.content).join('\n');
+        // Checked with .some() against the files themselves, not a pre-joined
+        // string: joining nearly the whole project's non-doc/non-SQL content into
+        // one string on every scan doubled peak memory for the full scanned corpus
+        // to answer what is, per project, a handful of existence checks that can
+        // each stop at the first matching file.
+        const codeFiles = ctx.files.filter((f) => !/\.(md|mdx|txt|rst|sql)$/i.test(f.rel));
+        const matchesAnyCodeFile = (re) => codeFiles.some((f) => re.test(f.content));
         const pgProject = ctx.detection.backends.includes('supabase') ||
             /\b(pg|postgres|postgresql|@supabase\/|postgres\.js|node-postgres|pg-promise)\b/i.test(pkg) ||
             /\b(psycopg|asyncpg|sqlalchemy\+postgres)\b/i.test(reqs);
         const hasD1 = ctx.files.some((f) => /(^|\/)wrangler\.(toml|jsonc?)$/.test(f.rel) && /d1_databases/.test(f.content));
         const sqliteProject = hasD1 ||
             /"(better-sqlite3|sqlite3|@libsql\/client)"/i.test(pkg) ||
-            /from\s+['"](bun:sqlite|drizzle-orm\/(d1|better-sqlite3|libsql))['"]/.test(codeAndEnv);
+            matchesAnyCodeFile(/from\s+['"](bun:sqlite|drizzle-orm\/(d1|better-sqlite3|libsql))['"]/);
         const mysqlProject = /"(mysql2?|mariadb)"/i.test(pkg);
         const sqliteLabel = hasD1 ? 'Cloudflare D1 (SQLite)' : 'SQLite';
         const PG_MARK = /(row\s+level\s+security|gen_random_uuid|\b(?:big)?serial\b|::\s*\w+|\bjsonb\b|\bplpgsql\b|create\s+policy|uuid_generate)/i;
@@ -655,8 +661,14 @@ export const rlsMigrationsChecker = {
                 file: skipped[0]?.file ?? '',
                 line: 1,
             }];
-        if (analyzed.length === 0)
-            return notApplicable;
+        // No early return here even when every SQL file present was a foreign
+        // engine (`analyzed.length === 0 && skipped.length > 0`): that settles
+        // those FILES (SQLite/MySQL truly have no RLS), but not the PROJECT — a
+        // Supabase project whose only local .sql happens to be a SQLite cache
+        // file has learned nothing about its real Postgres schema either. Both
+        // this case and zero SQL files at all fall through to the checks below,
+        // which decide from what was actually parsed (nothing, here) whether
+        // anything about the applicable backend's schema was learned.
         // "No RLS" is a hole only when untrusted clients reach the database directly
         // (Supabase/PostgREST with the anon key, Hasura). A Postgres that only server
         // code talks to has no RLS by default and is not exposed by that — a critical
@@ -664,11 +676,14 @@ export const rlsMigrationsChecker = {
         // the tool's audience is mostly Supabase, and unknown must not read as safe.
         const exposed = ctx.detection.backends.includes('supabase') ||
             /@supabase\//i.test(pkg) ||
-            /(\/rest\/v1\b|postgrest|hasura|SUPABASE_(?:ANON|PUBLISHABLE)_KEY|sb_publishable_)/i.test(codeAndEnv);
+            matchesAnyCodeFile(/(\/rest\/v1\b|postgrest|hasura|SUPABASE_(?:ANON|PUBLISHABLE)_KEY|sb_publishable_)/i);
         const serverOnly = !exposed &&
             (/"(pg|postgres|pg-promise|@prisma\/client|drizzle-orm|knex|kysely|typeorm|sequelize)"/i.test(pkg) ||
                 /\b(psycopg2?|asyncpg|sqlalchemy)\b/i.test(reqs));
-        const missingSeverity = exposed || !serverOnly ? 'critical' : 'warning';
+        // Server-only is 'advisory', not 'warning': the fix text for this exact
+        // case says "no action needed unless X" — a warning (−8 points, shown as
+        // a problem to look into) contradicted its own explanation of itself.
+        const missingSeverity = exposed || !serverOnly ? 'critical' : 'advisory';
         const events = [];
         const notUnderstood = [];
         analyzed.forEach((f, fileIdx) => {
@@ -682,7 +697,10 @@ export const rlsMigrationsChecker = {
         events.sort((a, b) => a.fileIdx - b.fileIdx || a.offset - b.offset);
         const state = new Map();
         for (const e of events) {
-            const cur = state.get(e.key) ?? { created: false, enabled: false, file: e.file, line: e.line, display: e.display, stateFile: e.file, guarded: false, keys: new Set([e.key]) };
+            const cur = state.get(e.key) ?? {
+                created: false, everCreated: false, everDropped: false, enabled: false, file: e.file, line: e.line,
+                display: e.display, stateFile: e.file, stateLine: e.line, guarded: false, keys: new Set([e.key]),
+            };
             if (e.kind === 'rename') {
                 const to = e.toKey;
                 cur.keys.add(to);
@@ -690,13 +708,14 @@ export const rlsMigrationsChecker = {
                     // Which name the table ends up under is unknown: keep it under both, both in doubt.
                     cur.guarded = true;
                     cur.stateFile = e.file;
+                    cur.stateLine = e.line;
                     state.set(e.key, cur);
                     if (!state.has(to))
                         state.set(to, { ...cur, keys: new Set(cur.keys), display: e.toDisplay ?? cur.display });
                     continue;
                 }
                 state.delete(e.key);
-                state.set(to, { ...cur, display: e.toDisplay ?? cur.display, stateFile: e.file });
+                state.set(to, { ...cur, display: e.toDisplay ?? cur.display, stateFile: e.file, stateLine: e.line });
                 continue;
             }
             // Doubt is a property of ANY guarded statement, not just a guarded ENABLE.
@@ -708,6 +727,7 @@ export const rlsMigrationsChecker = {
                 // (the outcome that leaves data exposed), and record the uncertainty.
                 if (e.kind === 'create' && !cur.created) {
                     cur.created = true;
+                    cur.everCreated = true;
                     cur.enabled = false;
                     cur.file = e.file;
                     cur.line = e.line;
@@ -719,6 +739,7 @@ export const rlsMigrationsChecker = {
                     cur.enabled = false;
                 cur.guarded = true;
                 cur.stateFile = e.file;
+                cur.stateLine = e.line;
                 state.set(e.key, cur);
                 continue;
             }
@@ -727,27 +748,33 @@ export const rlsMigrationsChecker = {
                     if (e.ifNotExists && cur.created)
                         break; // existing table: no-op, keep RLS state
                     cur.created = true;
+                    cur.everCreated = true;
                     cur.enabled = false;
                     cur.file = e.file;
                     cur.line = e.line;
                     cur.display = e.display;
                     cur.stateFile = e.file;
+                    cur.stateLine = e.line;
                     cur.guarded = false;
                     break;
                 case 'enable':
                     cur.enabled = true;
                     cur.stateFile = e.file;
+                    cur.stateLine = e.line;
                     cur.guarded = false;
                     break;
                 case 'disable':
                     cur.enabled = false;
                     cur.stateFile = e.file;
+                    cur.stateLine = e.line;
                     cur.guarded = false;
                     break;
                 case 'drop':
                     cur.created = false;
+                    cur.everDropped = true;
                     cur.enabled = false;
                     cur.stateFile = e.file;
+                    cur.stateLine = e.line;
                     cur.guarded = false;
                     break;
             }
@@ -765,40 +792,107 @@ export const rlsMigrationsChecker = {
         const turnsOff = (k) => k === 'disable' || k === 'create';
         const findings = [];
         for (const [key, s] of state) {
-            if (!s.created || isTempKey(key))
+            if (isTempKey(key))
                 continue; // temp tables are session-only: PostgREST never sees them
+            // Confirmed gone: created here then legitimately DROPped (the original,
+            // well-tested case), OR never created here at all but still reached by
+            // an unconditional DROP this scan DID see — an external table whose
+            // removal this repo's migrations confirm, not merely reference. Either
+            // way there is nothing left to hold RLS state, on or off.
+            if (!s.created && s.everDropped)
+                continue;
+            // Reaching here means one of two things: `s.created` (created here and
+            // still exists — the original, well-tested case), or `!s.everCreated`
+            // (this key is only ever the target of ALTER/RENAME — an EXTERNAL
+            // table this repo never creates, managed from the dashboard or a
+            // migration outside this scan). Both get the SAME ambiguity/guard
+            // evaluation below: a DISABLE right there in the scanned file is not
+            // "no information" just because we cannot confirm the table exists,
+            // and an unconditional ENABLE on either is equally provably safe.
+            // Reusing one model — instead of a second, separate one for external
+            // tables that has to relearn DROP/RENAME/guard/cross-directory order
+            // on its own — is what keeps them from disagreeing with each other.
+            const external = !s.everCreated;
             const ambiguous = events.some((e) => s.keys.has(e.key) && dirOf(e.file) !== dirOf(s.stateFile) && (s.enabled ? turnsOff(e.kind) : e.kind === 'enable'));
             if (s.enabled && !ambiguous && !s.guarded)
-                continue; // provably protected
+                continue; // provably protected (or provably fine, if external)
             // `guarded` means a statement we had to GUESS about decided this table's
             // state — a conditional ENABLE, DISABLE, CREATE, DROP or RENAME. Calling
             // that "critical" would be the same false confidence as calling it clean,
             // so it is reported as unconfirmed. A warning still fails CI (exit 1); it
             // just does not claim to know what only the database can tell.
-            const kind = ambiguous ? 'order' : s.guarded ? 'guarded' : 'missing';
+            const kind = external ? 'external' : ambiguous ? 'order' : s.guarded ? 'guarded' : 'missing';
             findings.push({
                 id: 'rls_missing',
                 severity: kind === 'missing' ? missingSeverity : 'warning',
-                title: kind === 'missing'
-                    ? (missingSeverity === 'critical'
-                        ? `Table "${s.display}" created without RLS`
-                        : `Table "${s.display}" has no RLS (server-only database)`)
-                    : kind === 'order' ? `Table "${s.display}" may end up without RLS (migration order unclear)`
-                        : `Table "${s.display}" has an unconfirmed RLS state (conditional block)`,
-                detail: kind === 'missing'
-                    ? (missingSeverity === 'critical'
-                        ? `"${s.display}" is created in a migration and its latest state does not enable Row Level Security. If this table holds user data on Supabase, the anon key can read every row.`
-                        : `"${s.display}" is created without Row Level Security. Only server code (pg/Prisma/…) appears to talk to this database, so nothing hands its rows to clients directly — that is normal, not a hole. It becomes CRITICAL the moment a client-facing data API (Supabase/PostgREST anon key, Hasura) is put in front of the same database.`)
-                    : kind === 'order'
-                        ? `"${s.display}" has statements in directories other than "${s.stateFile}" that contradict its final RLS state. Files in separate directories have no reliable apply order, so this cannot be decided statically — check the deployed state.`
-                        : `"${s.display}" has a table or RLS statement whose execution cannot be confirmed statically: inside an IF/LOOP branch or a block with an EXCEPTION handler, after a RETURN, in a rolled-back or unterminated transaction, or on a name a TEMP table may shadow. Whether it took effect cannot be decided without running the migration, so its RLS state is NOT confirmed — check the deployed state.`,
-                fix: `ALTER TABLE ${s.display} ENABLE ROW LEVEL SECURITY; then add an owner/tenant policy, and drop any permissive "USING (true)" policy (policies are OR-ed). This is a static hint — confirm the deployed state.`,
+                title: kind === 'external' ? `Table "${s.display}" may have RLS disabled here, but is never created in this repo`
+                    : kind === 'missing'
+                        ? (missingSeverity === 'critical'
+                            ? `Table "${s.display}" created without RLS`
+                            : `Table "${s.display}" has no RLS (server-only database)`)
+                        : kind === 'order' ? `Table "${s.display}" may end up without RLS (migration order unclear)`
+                            : `Table "${s.display}" has an unconfirmed RLS state (conditional block)`,
+                detail: kind === 'external'
+                    ? `"${s.display}" is not created by any migration this scan can see, but this project's SQL leaves it with Row Level Security off — or its state cannot be confirmed statically (a conditional branch, or statements in different directories with no reliable apply order). Either the table is real — created from the dashboard, or in a migration outside this repo — and RLS on it may now be off, or it does not exist and this is a no-op. This cannot be told apart statically — check the deployed state.`
+                    : kind === 'missing'
+                        ? (missingSeverity === 'critical'
+                            ? `"${s.display}" is created in a migration and its latest state does not enable Row Level Security. On Supabase the anon role has full table privileges by default, so with RLS off the public key can READ, INSERT, UPDATE and DELETE every row through the REST API. Static view only: this covers tables created by migrations in this repository — tables created from the dashboard or elsewhere are not listed here; the live probe enumerates all of them.`
+                            : `"${s.display}" is created without Row Level Security. Only server code (pg/Prisma/…) appears to talk to this database, so nothing hands its rows to clients directly — that is normal, not a hole. It becomes CRITICAL the moment a client-facing data API (Supabase/PostgREST anon key, Hasura) is put in front of the same database.`)
+                        : kind === 'order'
+                            ? `"${s.display}" has statements in directories other than "${s.stateFile}" that contradict its final RLS state. Files in separate directories have no reliable apply order, so this cannot be decided statically — check the deployed state.`
+                            : `"${s.display}" has a table or RLS statement whose execution cannot be confirmed statically: inside an IF/LOOP branch or a block with an EXCEPTION handler, after a RETURN, in a rolled-back or unterminated transaction, or on a name a TEMP table may shadow. Whether it took effect cannot be decided without running the migration, so its RLS state is NOT confirmed — check the deployed state.`,
+                // The REVOKE-from-anon step only makes sense where an `anon` role is a
+                // real thing to revoke from — the same condition `missingSeverity`
+                // itself uses. Recommending it unconditionally told a server-only
+                // Postgres user (no Supabase, no anon role) to revoke privileges from
+                // a role that does not exist in their database, right next to a
+                // detail explaining that RLS is not needed there at all. An external
+                // table gets its own fix: we do not even know it exists, so neither
+                // the anon-revoke step nor the server-only "nothing to do" fits.
+                fix: kind === 'external'
+                    ? `Confirm whether "${s.display}" exists in the deployed database. If it does, re-enable RLS: ALTER TABLE ${s.display} ENABLE ROW LEVEL SECURITY; and add an owner/tenant policy.`
+                    : exposed || !serverOnly
+                        ? `ALTER TABLE ${s.display} ENABLE ROW LEVEL SECURITY; then add an owner/tenant policy, and drop any permissive "USING (true)" policy (policies are OR-ed). Until policies exist, stop the bleeding without breaking reads: REVOKE INSERT, UPDATE, DELETE, TRUNCATE ON ${s.display} FROM anon; This is a static hint — confirm the deployed state.`
+                        : `No action needed unless a client-facing data API (Supabase/PostgREST, Hasura) is ever put in front of this database — if it is, first ALTER TABLE ${s.display} ENABLE ROW LEVEL SECURITY and add an owner/tenant policy, then REVOKE INSERT, UPDATE, DELETE, TRUNCATE ON ${s.display} FROM the role that API uses to connect.`,
                 checker: 'rls-migrations',
                 level: 0,
-                file: s.file,
-                line: s.line,
+                file: external ? s.stateFile : s.file,
+                line: external ? s.stateLine : s.line,
             });
         }
+        // Zero findings can mean two very different things: every table here has
+        // RLS handled correctly, or no table definition was ever found in the SQL
+        // at all — a maintenance script (`SELECT now();`), a seed file with no
+        // CREATE TABLE (schema itself made from the dashboard), or literally zero
+        // .sql files. `sqlFiles.length === 0` alone used to gate this and missed
+        // the first two: presence of a .sql file is not presence of schema
+        // information. `events` tells the two apart directly — a table that was
+        // found and IS clean still produced a 'create' event, just no finding.
+        //
+        // A TEMP table's own 'create' does NOT count: it is session-only and
+        // PostgREST never sees it (the same reason it is excluded from findings
+        // below), so a migration that creates only a staging TEMP table — even
+        // one that also DISABLEs RLS on a persistent table this repo never
+        // defines — learned nothing about the real, permanent schema either.
+        // `findings.length > 0` also counts as "learned something": an external
+        // table (no local CREATE at all) can still produce a real finding — an
+        // explicit DISABLE sitting right in the scanned file — and that finding
+        // must not be thrown away just because no CREATE ever ran anywhere.
+        const sawAnyTable = findings.length > 0 || events.some((e) => e.kind === 'create' && !isTempKey(e.key));
+        if (!sawAnyTable && notUnderstood.length === 0 && ctx.detection.backends.includes('supabase')) {
+            return {
+                findings: [...notApplicable, {
+                        id: 'rls_unverifiable_no_migrations',
+                        severity: 'info',
+                        title: 'No table definitions found in SQL — RLS could not be checked statically',
+                        detail: 'This project talks to Supabase, but no CREATE TABLE (or SELECT ... INTO) was found in any .sql file here — either there are no migrations, or the ones present (a seed script, a maintenance query) do not define a schema. The schema may be managed from the dashboard, or migrations may live in a different repo. A static scan can only see table/RLS state from files it can read, so no table here could be verified this way — this is missing information, not a clean result.',
+                        fix: 'Run the live probe (consent + --i-own-this) to enumerate which tables the anon key can read, or check pg_class.relrowsecurity and pg_policies directly in the Supabase SQL editor.',
+                        checker: 'rls-migrations',
+                        level: 0,
+                    }],
+                partial: 'no table definitions found in SQL for a Supabase project — RLS could not be checked for any table',
+            };
+        }
         const all = [...findings, ...notApplicable];
         if (notUnderstood.length === 0)
             return all;