easyvibegate 0.6.2 → 0.6.9

package/dist/engine/checkers/static/next-image-ssrf.js

@@ -0,0 +1,137 @@
+import { lineAt } from '../../util/text.js';
+import { maskCode } from '../../util/mask.js';
+const NEXT_CONFIG_RE = /(^|\/)next\.config\.(js|mjs|cjs|ts)$/;
+const MIDDLEWARE_RE = /(^|\/)middleware\.(js|mjs|ts)$/;
+/**
+ * A `remotePatterns` entry with a wildcard hostname. Next.js's built-in image
+ * optimizer (`/_next/image?url=...`) will then fetch ANY https URL a caller
+ * gives it and return the decoded result — a textbook SSRF primitive (probe
+ * internal services, cloud metadata endpoints, port-scan the private network)
+ * independent of whatever RCE a given `next`/`sharp` version does or doesn't
+ * carry this month. Flagging only the version misses this: upgrading closes
+ * today's CVE but leaves the wildcard open for the next one.
+ */
+const WILDCARD_HOSTNAME = /hostname\s*:\s*["'`]\*{1,2}["'`]/;
+const REMOTE_PATTERNS_BLOCK = /remotePatterns\s*:\s*\[/g;
+/** How far past `remotePatterns: [` to look for a wildcard entry inside it. */
+const BLOCK_WINDOW = 2000;
+/**
+ * The Next.js docs' own idiom for "run this middleware on everything except
+ * X": a negative lookahead inside the matcher regex,
+ * `'/((?!_next/static|_next/image|favicon.ico).*)'`. `_next/image` appearing
+ * inside a matcher block that also contains a lookahead means the image
+ * optimizer is explicitly carved out of whatever auth gate this middleware
+ * otherwise enforces — reachable with no session at all.
+ */
+const MATCHER_BLOCK = /matcher\s*[:=]/g;
+const MATCHER_WINDOW = 500;
+const dirOf = (rel) => {
+    const i = rel.lastIndexOf('/');
+    return i === -1 ? '' : rel.slice(0, i);
+};
+/** middleware.ts commonly sits at the app root OR under src/ — normalize both to the app root. */
+const appRootOf = (rel) => {
+    const d = dirOf(rel);
+    return d.endsWith('/src') ? d.slice(0, -4) : d === 'src' ? '' : d;
+};
+function findWildcardRemotePatterns(content) {
+    const hits = [];
+    for (const m of content.matchAll(REMOTE_PATTERNS_BLOCK)) {
+        const start = (m.index ?? 0) + m[0].length;
+        const window = content.slice(start, start + BLOCK_WINDOW);
+        // Stop at the block's own closing `]` when it's inside the window, so a
+        // SECOND, unrelated remotePatterns array later in a long file is not
+        // credited with this one's wildcard.
+        const closeAt = window.indexOf(']');
+        const scoped = closeAt === -1 ? window : window.slice(0, closeAt);
+        if (WILDCARD_HOSTNAME.test(scoped))
+            hits.push(m.index ?? 0);
+    }
+    return hits;
+}
+function findImageExcludedMatchers(content) {
+    const hits = [];
+    for (const m of content.matchAll(MATCHER_BLOCK)) {
+        const start = m.index ?? 0;
+        const window = content.slice(start, start + MATCHER_WINDOW);
+        if (window.includes('(?!') && window.includes('_next/image'))
+            hits.push(start);
+    }
+    return hits;
+}
+/**
+ * Correlates two static signals that no per-file, per-checker rule can see
+ * together: an image optimizer open to any host (`next.config.*`), and an
+ * auth middleware that explicitly exempts the optimizer's own route
+ * (`middleware.*`). Neither file alone shows the hole; grep for either one in
+ * isolation reads as routine Next.js configuration.
+ */
+export const nextImageSsrfChecker = {
+    id: 'next-image-ssrf',
+    title: 'Next.js image optimizer open to any host',
+    level: 0,
+    run(ctx) {
+        const configFiles = ctx.files.filter((f) => NEXT_CONFIG_RE.test(f.rel));
+        const middlewareFiles = ctx.files.filter((f) => MIDDLEWARE_RE.test(f.rel));
+        const wildcardHits = [];
+        // Comments never count as config: `// hostname: '**' — SSRF risk, do not
+        // do this` in a file that sets a real, specific hostname must not fire.
+        for (const f of configFiles) {
+            const masked = maskCode(f.content, { file: f.rel });
+            for (const index of findWildcardRemotePatterns(masked))
+                wildcardHits.push({ file: f.rel, index });
+        }
+        if (wildcardHits.length === 0)
+            return { findings: [] };
+        const excludedHits = [];
+        for (const f of middlewareFiles) {
+            const masked = maskCode(f.content, { file: f.rel });
+            for (const index of findImageExcludedMatchers(masked))
+                excludedHits.push({ file: f.rel, index });
+        }
+        // Pair a config hit with a middleware hit when there is only one of each
+        // in the whole project (the common single-app case), or when one file's
+        // app root is a prefix of the other's (a monorepo with `apps/<name>/`).
+        const pairFor = (configFile) => {
+            if (excludedHits.length === 1)
+                return excludedHits[0];
+            const root = appRootOf(configFile);
+            return excludedHits.find((h) => {
+                const hRoot = appRootOf(h.file);
+                return hRoot === root || hRoot.startsWith(root ? `${root}/` : '') || (root.startsWith(hRoot ? `${hRoot}/` : '') && hRoot !== '');
+            });
+        };
+        const findings = [];
+        for (const hit of wildcardHits) {
+            const file = ctx.files.find((f) => f.rel === hit.file);
+            const line = file ? lineAt(file.content, hit.index) : 1;
+            const paired = configFiles.length === 1 ? excludedHits[0] : pairFor(hit.file);
+            if (paired) {
+                findings.push({
+                    id: 'next_image_ssrf_unauth',
+                    severity: 'critical',
+                    title: 'Next.js image optimizer is open to any host AND reachable without auth',
+                    detail: `${hit.file}:${line} allows the built-in image optimizer (${'/_next/image'}) to fetch an https URL from ANY host (a wildcard \`hostname\` in \`remotePatterns\`). ${paired.file} explicitly excludes \`_next/image\` from its auth matcher, so any unauthenticated caller can make this server fetch an attacker-chosen URL — a classic SSRF (internal services, cloud metadata endpoints, private-network scanning), and a live vector for whatever RCE the installed \`next\`/\`sharp\` version carries in its image decoder. One \`GET\` request against the real path confirms this without needing to read either file in isolation.`,
+                    fix: 'Restrict `images.remotePatterns` to the specific hosts you actually serve images from — never a bare `\'*\'`/`\'**\'` hostname. If the optimizer must stay open to arbitrary hosts, remove `_next/image` from the middleware matcher exclusion so it is not reachable pre-auth. Also keep `next` and `sharp` on a current, patched version — the wildcard host and the decoder CVEs compound each other.',
+                    checker: 'next-image-ssrf',
+                    level: 0,
+                    file: hit.file,
+                    line,
+                });
+                continue;
+            }
+            findings.push({
+                id: 'next_image_ssrf_open',
+                severity: 'warning',
+                title: 'Next.js image optimizer accepts any remote host',
+                detail: `${hit.file}:${line} sets a wildcard \`hostname\` in \`images.remotePatterns\`, so the built-in image optimizer will fetch an https URL from any host a caller supplies. This is an SSRF primitive on its own — internal services, cloud metadata endpoints, and the private network become reachable through this server — independent of whether \`_next/image\` also sits behind auth.`,
+                fix: 'List the specific hosts you actually serve images from in `remotePatterns` instead of a bare `\'*\'`/`\'**\'` hostname. If the route is not behind auth, this is worth fixing regardless of the current `next`/`sharp` version.',
+                checker: 'next-image-ssrf',
+                level: 0,
+                file: hit.file,
+                line,
+            });
+        }
+        return { findings };
+    },
+};

package/dist/engine/checkers/static/rls-migrations.js

@@ -592,26 +592,6 @@ export const rlsMigrationsChecker = {
     level: 0,
     run(ctx) {
         const sqlFiles = ctx.files.filter((f) => f.ext === '.sql').sort((a, b) => a.rel.localeCompare(b.rel));
-        if (sqlFiles.length === 0) {
-            // A project that clearly talks to Supabase but ships no .sql migrations
-            // (schema managed from the dashboard, or migrations live in another repo)
-            // used to just say nothing — a silent, undeserved clean score on the exact
-            // check the tool exists for. Say what could not be checked instead.
-            const looksSupabase = ctx.detection.backends.includes('supabase') ||
-                ctx.files.some((f) => !/\.(md|mdx|txt|rst)$/i.test(f.rel) &&
-                    /(SUPABASE_(?:ANON|PUBLISHABLE)_KEY|sb_publishable_|\/rest\/v1\b|postgrest)/i.test(f.content));
-            if (!looksSupabase)
-                return [];
-            return [{
-                    id: 'rls_unverifiable_no_migrations',
-                    severity: 'info',
-                    title: 'No SQL migrations found — RLS could not be checked statically',
-                    detail: 'This project talks to Supabase, but no .sql migration files exist in this repository (the schema may be managed from the dashboard, or migrations live in a different repo). A static scan can only see table/RLS state from files it can read, so no table here could be verified this way — this is missing information, not a clean result.',
-                    fix: 'Run the live probe (consent + --i-own-this) to enumerate which tables the anon key can read, or check pg_class.relrowsecurity and pg_policies directly in the Supabase SQL editor.',
-                    checker: 'rls-migrations',
-                    level: 0,
-                }];
-        }
         // RLS is a PostgreSQL feature. The engine is decided per FILE, not per
         // project: a monorepo can hold a Postgres schema next to a Cloudflare D1
         // (SQLite) one, and a SQLite schema must never be told to enable RLS — that
@@ -681,8 +661,14 @@ export const rlsMigrationsChecker = {
                 file: skipped[0]?.file ?? '',
                 line: 1,
             }];
-        if (analyzed.length === 0)
-            return notApplicable;
+        // No early return here even when every SQL file present was a foreign
+        // engine (`analyzed.length === 0 && skipped.length > 0`): that settles
+        // those FILES (SQLite/MySQL truly have no RLS), but not the PROJECT — a
+        // Supabase project whose only local .sql happens to be a SQLite cache
+        // file has learned nothing about its real Postgres schema either. Both
+        // this case and zero SQL files at all fall through to the checks below,
+        // which decide from what was actually parsed (nothing, here) whether
+        // anything about the applicable backend's schema was learned.
         // "No RLS" is a hole only when untrusted clients reach the database directly
         // (Supabase/PostgREST with the anon key, Hasura). A Postgres that only server
         // code talks to has no RLS by default and is not exposed by that — a critical
@@ -694,7 +680,10 @@ export const rlsMigrationsChecker = {
         const serverOnly = !exposed &&
             (/"(pg|postgres|pg-promise|@prisma\/client|drizzle-orm|knex|kysely|typeorm|sequelize)"/i.test(pkg) ||
                 /\b(psycopg2?|asyncpg|sqlalchemy)\b/i.test(reqs));
-        const missingSeverity = exposed || !serverOnly ? 'critical' : 'warning';
+        // Server-only is 'advisory', not 'warning': the fix text for this exact
+        // case says "no action needed unless X" — a warning (−8 points, shown as
+        // a problem to look into) contradicted its own explanation of itself.
+        const missingSeverity = exposed || !serverOnly ? 'critical' : 'advisory';
         const events = [];
         const notUnderstood = [];
         analyzed.forEach((f, fileIdx) => {
@@ -708,7 +697,10 @@ export const rlsMigrationsChecker = {
         events.sort((a, b) => a.fileIdx - b.fileIdx || a.offset - b.offset);
         const state = new Map();
         for (const e of events) {
-            const cur = state.get(e.key) ?? { created: false, enabled: false, file: e.file, line: e.line, display: e.display, stateFile: e.file, guarded: false, keys: new Set([e.key]) };
+            const cur = state.get(e.key) ?? {
+                created: false, everCreated: false, everDropped: false, enabled: false, file: e.file, line: e.line,
+                display: e.display, stateFile: e.file, stateLine: e.line, guarded: false, keys: new Set([e.key]),
+            };
             if (e.kind === 'rename') {
                 const to = e.toKey;
                 cur.keys.add(to);
@@ -716,13 +708,14 @@ export const rlsMigrationsChecker = {
                     // Which name the table ends up under is unknown: keep it under both, both in doubt.
                     cur.guarded = true;
                     cur.stateFile = e.file;
+                    cur.stateLine = e.line;
                     state.set(e.key, cur);
                     if (!state.has(to))
                         state.set(to, { ...cur, keys: new Set(cur.keys), display: e.toDisplay ?? cur.display });
                     continue;
                 }
                 state.delete(e.key);
-                state.set(to, { ...cur, display: e.toDisplay ?? cur.display, stateFile: e.file });
+                state.set(to, { ...cur, display: e.toDisplay ?? cur.display, stateFile: e.file, stateLine: e.line });
                 continue;
             }
             // Doubt is a property of ANY guarded statement, not just a guarded ENABLE.
@@ -734,6 +727,7 @@ export const rlsMigrationsChecker = {
                 // (the outcome that leaves data exposed), and record the uncertainty.
                 if (e.kind === 'create' && !cur.created) {
                     cur.created = true;
+                    cur.everCreated = true;
                     cur.enabled = false;
                     cur.file = e.file;
                     cur.line = e.line;
@@ -745,6 +739,7 @@ export const rlsMigrationsChecker = {
                     cur.enabled = false;
                 cur.guarded = true;
                 cur.stateFile = e.file;
+                cur.stateLine = e.line;
                 state.set(e.key, cur);
                 continue;
             }
@@ -753,27 +748,33 @@ export const rlsMigrationsChecker = {
                     if (e.ifNotExists && cur.created)
                         break; // existing table: no-op, keep RLS state
                     cur.created = true;
+                    cur.everCreated = true;
                     cur.enabled = false;
                     cur.file = e.file;
                     cur.line = e.line;
                     cur.display = e.display;
                     cur.stateFile = e.file;
+                    cur.stateLine = e.line;
                     cur.guarded = false;
                     break;
                 case 'enable':
                     cur.enabled = true;
                     cur.stateFile = e.file;
+                    cur.stateLine = e.line;
                     cur.guarded = false;
                     break;
                 case 'disable':
                     cur.enabled = false;
                     cur.stateFile = e.file;
+                    cur.stateLine = e.line;
                     cur.guarded = false;
                     break;
                 case 'drop':
                     cur.created = false;
+                    cur.everDropped = true;
                     cur.enabled = false;
                     cur.stateFile = e.file;
+                    cur.stateLine = e.line;
                     cur.guarded = false;
                     break;
             }
@@ -791,40 +792,107 @@ export const rlsMigrationsChecker = {
         const turnsOff = (k) => k === 'disable' || k === 'create';
         const findings = [];
         for (const [key, s] of state) {
-            if (!s.created || isTempKey(key))
+            if (isTempKey(key))
                 continue; // temp tables are session-only: PostgREST never sees them
+            // Confirmed gone: created here then legitimately DROPped (the original,
+            // well-tested case), OR never created here at all but still reached by
+            // an unconditional DROP this scan DID see — an external table whose
+            // removal this repo's migrations confirm, not merely reference. Either
+            // way there is nothing left to hold RLS state, on or off.
+            if (!s.created && s.everDropped)
+                continue;
+            // Reaching here means one of two things: `s.created` (created here and
+            // still exists — the original, well-tested case), or `!s.everCreated`
+            // (this key is only ever the target of ALTER/RENAME — an EXTERNAL
+            // table this repo never creates, managed from the dashboard or a
+            // migration outside this scan). Both get the SAME ambiguity/guard
+            // evaluation below: a DISABLE right there in the scanned file is not
+            // "no information" just because we cannot confirm the table exists,
+            // and an unconditional ENABLE on either is equally provably safe.
+            // Reusing one model — instead of a second, separate one for external
+            // tables that has to relearn DROP/RENAME/guard/cross-directory order
+            // on its own — is what keeps them from disagreeing with each other.
+            const external = !s.everCreated;
             const ambiguous = events.some((e) => s.keys.has(e.key) && dirOf(e.file) !== dirOf(s.stateFile) && (s.enabled ? turnsOff(e.kind) : e.kind === 'enable'));
             if (s.enabled && !ambiguous && !s.guarded)
-                continue; // provably protected
+                continue; // provably protected (or provably fine, if external)
             // `guarded` means a statement we had to GUESS about decided this table's
             // state — a conditional ENABLE, DISABLE, CREATE, DROP or RENAME. Calling
             // that "critical" would be the same false confidence as calling it clean,
             // so it is reported as unconfirmed. A warning still fails CI (exit 1); it
             // just does not claim to know what only the database can tell.
-            const kind = ambiguous ? 'order' : s.guarded ? 'guarded' : 'missing';
+            const kind = external ? 'external' : ambiguous ? 'order' : s.guarded ? 'guarded' : 'missing';
             findings.push({
                 id: 'rls_missing',
                 severity: kind === 'missing' ? missingSeverity : 'warning',
-                title: kind === 'missing'
-                    ? (missingSeverity === 'critical'
-                        ? `Table "${s.display}" created without RLS`
-                        : `Table "${s.display}" has no RLS (server-only database)`)
-                    : kind === 'order' ? `Table "${s.display}" may end up without RLS (migration order unclear)`
-                        : `Table "${s.display}" has an unconfirmed RLS state (conditional block)`,
-                detail: kind === 'missing'
-                    ? (missingSeverity === 'critical'
-                        ? `"${s.display}" is created in a migration and its latest state does not enable Row Level Security. On Supabase the anon role has full table privileges by default, so with RLS off the public key can READ, INSERT, UPDATE and DELETE every row through the REST API. Static view only: this covers tables created by migrations in this repository — tables created from the dashboard or elsewhere are not listed here; the live probe enumerates all of them.`
-                        : `"${s.display}" is created without Row Level Security. Only server code (pg/Prisma/…) appears to talk to this database, so nothing hands its rows to clients directly — that is normal, not a hole. It becomes CRITICAL the moment a client-facing data API (Supabase/PostgREST anon key, Hasura) is put in front of the same database.`)
-                    : kind === 'order'
-                        ? `"${s.display}" has statements in directories other than "${s.stateFile}" that contradict its final RLS state. Files in separate directories have no reliable apply order, so this cannot be decided statically — check the deployed state.`
-                        : `"${s.display}" has a table or RLS statement whose execution cannot be confirmed statically: inside an IF/LOOP branch or a block with an EXCEPTION handler, after a RETURN, in a rolled-back or unterminated transaction, or on a name a TEMP table may shadow. Whether it took effect cannot be decided without running the migration, so its RLS state is NOT confirmed — check the deployed state.`,
-                fix: `ALTER TABLE ${s.display} ENABLE ROW LEVEL SECURITY; then add an owner/tenant policy, and drop any permissive "USING (true)" policy (policies are OR-ed). Until policies exist, stop the bleeding without breaking reads: REVOKE INSERT, UPDATE, DELETE, TRUNCATE ON ${s.display} FROM anon; This is a static hint — confirm the deployed state.`,
+                title: kind === 'external' ? `Table "${s.display}" may have RLS disabled here, but is never created in this repo`
+                    : kind === 'missing'
+                        ? (missingSeverity === 'critical'
+                            ? `Table "${s.display}" created without RLS`
+                            : `Table "${s.display}" has no RLS (server-only database)`)
+                        : kind === 'order' ? `Table "${s.display}" may end up without RLS (migration order unclear)`
+                            : `Table "${s.display}" has an unconfirmed RLS state (conditional block)`,
+                detail: kind === 'external'
+                    ? `"${s.display}" is not created by any migration this scan can see, but this project's SQL leaves it with Row Level Security off — or its state cannot be confirmed statically (a conditional branch, or statements in different directories with no reliable apply order). Either the table is real — created from the dashboard, or in a migration outside this repo — and RLS on it may now be off, or it does not exist and this is a no-op. This cannot be told apart statically — check the deployed state.`
+                    : kind === 'missing'
+                        ? (missingSeverity === 'critical'
+                            ? `"${s.display}" is created in a migration and its latest state does not enable Row Level Security. On Supabase the anon role has full table privileges by default, so with RLS off the public key can READ, INSERT, UPDATE and DELETE every row through the REST API. Static view only: this covers tables created by migrations in this repository — tables created from the dashboard or elsewhere are not listed here; the live probe enumerates all of them.`
+                            : `"${s.display}" is created without Row Level Security. Only server code (pg/Prisma/…) appears to talk to this database, so nothing hands its rows to clients directly — that is normal, not a hole. It becomes CRITICAL the moment a client-facing data API (Supabase/PostgREST anon key, Hasura) is put in front of the same database.`)
+                        : kind === 'order'
+                            ? `"${s.display}" has statements in directories other than "${s.stateFile}" that contradict its final RLS state. Files in separate directories have no reliable apply order, so this cannot be decided statically — check the deployed state.`
+                            : `"${s.display}" has a table or RLS statement whose execution cannot be confirmed statically: inside an IF/LOOP branch or a block with an EXCEPTION handler, after a RETURN, in a rolled-back or unterminated transaction, or on a name a TEMP table may shadow. Whether it took effect cannot be decided without running the migration, so its RLS state is NOT confirmed — check the deployed state.`,
+                // The REVOKE-from-anon step only makes sense where an `anon` role is a
+                // real thing to revoke from — the same condition `missingSeverity`
+                // itself uses. Recommending it unconditionally told a server-only
+                // Postgres user (no Supabase, no anon role) to revoke privileges from
+                // a role that does not exist in their database, right next to a
+                // detail explaining that RLS is not needed there at all. An external
+                // table gets its own fix: we do not even know it exists, so neither
+                // the anon-revoke step nor the server-only "nothing to do" fits.
+                fix: kind === 'external'
+                    ? `Confirm whether "${s.display}" exists in the deployed database. If it does, re-enable RLS: ALTER TABLE ${s.display} ENABLE ROW LEVEL SECURITY; and add an owner/tenant policy.`
+                    : exposed || !serverOnly
+                        ? `ALTER TABLE ${s.display} ENABLE ROW LEVEL SECURITY; then add an owner/tenant policy, and drop any permissive "USING (true)" policy (policies are OR-ed). Until policies exist, stop the bleeding without breaking reads: REVOKE INSERT, UPDATE, DELETE, TRUNCATE ON ${s.display} FROM anon; This is a static hint — confirm the deployed state.`
+                        : `No action needed unless a client-facing data API (Supabase/PostgREST, Hasura) is ever put in front of this database — if it is, first ALTER TABLE ${s.display} ENABLE ROW LEVEL SECURITY and add an owner/tenant policy, then REVOKE INSERT, UPDATE, DELETE, TRUNCATE ON ${s.display} FROM the role that API uses to connect.`,
                 checker: 'rls-migrations',
                 level: 0,
-                file: s.file,
-                line: s.line,
+                file: external ? s.stateFile : s.file,
+                line: external ? s.stateLine : s.line,
             });
         }
+        // Zero findings can mean two very different things: every table here has
+        // RLS handled correctly, or no table definition was ever found in the SQL
+        // at all — a maintenance script (`SELECT now();`), a seed file with no
+        // CREATE TABLE (schema itself made from the dashboard), or literally zero
+        // .sql files. `sqlFiles.length === 0` alone used to gate this and missed
+        // the first two: presence of a .sql file is not presence of schema
+        // information. `events` tells the two apart directly — a table that was
+        // found and IS clean still produced a 'create' event, just no finding.
+        //
+        // A TEMP table's own 'create' does NOT count: it is session-only and
+        // PostgREST never sees it (the same reason it is excluded from findings
+        // below), so a migration that creates only a staging TEMP table — even
+        // one that also DISABLEs RLS on a persistent table this repo never
+        // defines — learned nothing about the real, permanent schema either.
+        // `findings.length > 0` also counts as "learned something": an external
+        // table (no local CREATE at all) can still produce a real finding — an
+        // explicit DISABLE sitting right in the scanned file — and that finding
+        // must not be thrown away just because no CREATE ever ran anywhere.
+        const sawAnyTable = findings.length > 0 || events.some((e) => e.kind === 'create' && !isTempKey(e.key));
+        if (!sawAnyTable && notUnderstood.length === 0 && ctx.detection.backends.includes('supabase')) {
+            return {
+                findings: [...notApplicable, {
+                        id: 'rls_unverifiable_no_migrations',
+                        severity: 'info',
+                        title: 'No table definitions found in SQL — RLS could not be checked statically',
+                        detail: 'This project talks to Supabase, but no CREATE TABLE (or SELECT ... INTO) was found in any .sql file here — either there are no migrations, or the ones present (a seed script, a maintenance query) do not define a schema. The schema may be managed from the dashboard, or migrations may live in a different repo. A static scan can only see table/RLS state from files it can read, so no table here could be verified this way — this is missing information, not a clean result.',
+                        fix: 'Run the live probe (consent + --i-own-this) to enumerate which tables the anon key can read, or check pg_class.relrowsecurity and pg_policies directly in the Supabase SQL editor.',
+                        checker: 'rls-migrations',
+                        level: 0,
+                    }],
+                partial: 'no table definitions found in SQL for a Supabase project — RLS could not be checked for any table',
+            };
+        }
         const all = [...findings, ...notApplicable];
         if (notUnderstood.length === 0)
             return all;