kryptheon-night 0.1.22 → 0.1.26

package/finding.js

@@ -88,6 +88,11 @@ function listOf(items) {
   return list.slice(0, -1).join(', ') + ' and ' + list[list.length - 1];
 }
 
+/** One of a table's things: workspaces -> workspace, companies -> company. */
+function oneOf(table) {
+  return String(table || 'team').replace(/ies$/, 'y').replace(/s$/, '');
+}
+
 /* --------------------------------------------------------------------------
    How bad it is.
 -------------------------------------------------------------------------- */
@@ -105,6 +110,11 @@ function severityOf(finding, contents) {
     // because the app is broken for whoever it fails for, but not a break-in.
     return 'HIGH';
   }
+  if (finding.kind === 'role' || finding.kind === 'bucket') {
+    // Something to check, never a confirmed break: whether a viewer may edit,
+    // or a bucket may be public, is the owner's decision. So never CRITICAL.
+    return 'HIGH';
+  }
   if (finding.kind === 'privileged') {
     // Not proven, so never CRITICAL: this is a reach that exists, not a break
     // that was demonstrated. A function anon can call that also writes is worth
@@ -291,6 +301,17 @@ function causeOf(finding) {
 /** What a caller could do, written the way a person would say it. */
 const WRITE_WORDS = { add: 'add rows to', change: 'change rows in', delete: 'delete rows from' };
 
+/**
+ * The error a looping rule produces, as Postgres words it. A rule that reads
+ * its own table directly is caught as recursion and named; one that reaches
+ * it through a helper function runs out of stack, and Postgres names nothing.
+ */
+function loopError(finding) {
+  return finding.deep
+    ? '"stack depth limit exceeded"'
+    : '"infinite recursion detected in policy for relation ' + finding.table + '"';
+}
+
 /** Who a looping rule fails for, said the way the headline and body need it. */
 function loopVictims(finding) {
   const callers = finding.callers || [];
@@ -321,6 +342,15 @@ function headlineFor(finding) {
   if (finding.kind === 'privileged') {
     return 'Anyone on the internet can call your ' + finding.fn + ' function, and it runs with full rights.';
   }
+  if (finding.kind === 'role') {
+    const order = ['delete', 'change', 'add'];
+    const does = order.filter((what) => (finding.can || []).includes(what)).map((what) => WRITE_WORDS[what]);
+    return 'A "' + finding.who + '" in a ' + oneOf(finding.parent) + ' can ' + listOf(does) + ' your ' +
+      finding.table + ' table.';
+  }
+  if (finding.kind === 'bucket') {
+    return 'Your ' + finding.table + ' storage bucket is public, but a rule says only some people may read it.';
+  }
   if (finding.kind === 'exposed') {
     return 'Your ' + finding.table + ' ' + (finding.isView ? 'view' : 'table') + ' can be read by anyone.';
   }
@@ -363,8 +393,9 @@ function bodyFor(finding, contents) {
     const one = reads.length === 1;
     return (
       'Using ' + listOf(reads) + ' on a copy of your app as ' + as.join(' and as ') +
-      ', every request was refused with "infinite recursion detected in policy for relation ' +
-      finding.table + '". Every page in your app that uses ' + (one ? 'that table' : 'those tables') +
+      ', every request was refused with ' + loopError(finding) +
+      (finding.deep ? ' - a rule on ' + finding.table + ' calls a helper that reads ' + finding.table + ' again, which runs the rule again' : '') +
+      '. Every page in your app that uses ' + (one ? 'that table' : 'those tables') +
       ' fails the same way for ' + loopVictims(finding).replace(/,$/, '') + '. It also means I could ' +
       'not test ' + (one ? 'it' : 'them') + ' for leaks - those attacks are listed at the end.'
     );
@@ -403,6 +434,36 @@ function bodyFor(finding, contents) {
       'kept, and your live app was never touched.';
   }
 
+  if (finding.kind === 'role') {
+    // Said as what was done, and then whose decision it is: a viewer who may
+    // edit is a hole in one app and the design of another.
+    const did = [];
+    const rows = (n) => n + (n === 1 ? ' row' : ' rows');
+    if ((finding.can || []).includes('change')) did.push('changed ' + rows((finding.changed || {}).change || 1));
+    if ((finding.can || []).includes('delete')) did.push('deleted ' + rows((finding.changed || {}).delete || 1));
+    const place = oneOf(finding.parent);
+    return (
+      'I put one of my fake people into the other one\'s ' + place + ' as a "' + finding.who +
+      '" - the lowest role in ' + finding.via + '.' + finding.roleColumn + ' - and, signed in as them, I ' +
+      listOf(did) + ' in ' + finding.table + ' that belonged to that ' + place + ', on a copy of your app. ' +
+      'Before joining, they could not. Every one of those was undone straight away. Whether a "' + finding.who +
+      '" may do this is your decision: if it is meant to, nothing needs fixing; if a "' + finding.who +
+      '" should only look, the rules on this table let them do more.'
+    );
+  }
+
+  if (finding.kind === 'bucket') {
+    // Said as what was read, never as a file taken: no file was opened.
+    return (
+      'In Supabase Storage the bucket "' + finding.bucket + '" is set to public, so anyone with a ' +
+      'file\'s link can download it without logging in - the rules on storage.objects are not asked. ' +
+      'You also wrote ' + ((finding.rules || []).length === 1 ? 'a rule' : 'rules') + ' saying who may read it (' +
+      listOf(finding.rules || []) + '), so it was probably meant to be private. I only read the ' +
+      'bucket\'s setting and its rules; I did not open or list any file. Whether it should be public ' +
+      'is yours to say.'
+    );
+  }
+
   if (finding.kind === 'privileged') {
     // Said as what is true, not as what was done - nothing was executed. The
     // reach is real; whether it is a mistake is the person's to say, so the
@@ -662,8 +723,8 @@ function fixPromptFor(finding) {
       'My app has a broken database rule.',
       '',
       'A row level security policy on the "' + finding.table + '" table reads "' + finding.table +
-        '" itself, so Postgres stops every request that touches it with "infinite recursion ' +
-        'detected in policy for relation ' + finding.table + '". I saw it when using ' +
+        '" itself' + (finding.deep ? ', through a helper function it calls,' : '') +
+        ' so Postgres stops every request that touches it with ' + loopError(finding) + '. I saw it when using ' +
         listOf((finding.reads || []).map((t) => '"' + t + '"')) + '.',
       '',
       'Show me the policies on "' + finding.table + '" and on every table whose policy reads "' +
@@ -682,6 +743,50 @@ function fixPromptFor(finding) {
       'Then sign in as an ordinary user and open the pages that use these tables, and run this ' +
         'check again - the tables it could not test will be tested this time.',
     ]
+    : finding.kind === 'role'
+    ? [
+      'My app may have a permissions problem - please check it rather than assume it.',
+      '',
+      'In my database, a member of a ' + oneOf(finding.parent) + ' whose role in "' + finding.via + '"."' +
+        finding.roleColumn + '" is "' + finding.who + '" can ' +
+        listOf((finding.can || []).map((what) => ({ change: 'change', delete: 'delete' })[what])) +
+        ' rows of that ' + oneOf(finding.parent) + ' in the "' + finding.table + '" table. This was proved ' +
+        'on a copy of the database: a "' + finding.who + '" was added, and the writes went through.',
+      '',
+      'First tell me: should a "' + finding.who + '" be able to do that? If yes, change nothing.',
+      '',
+      'If not, make the rules on "' + finding.table + '" that cover UPDATE, DELETE, INSERT or ALL check ' +
+        'the member\'s role as well as membership - for example with a helper that reads "' + finding.via +
+        '" for auth.uid() and the roles allowed to edit. Postgres lets a write through if ANY permissive ' +
+        'policy allows it, so a strict rule beside a loose one does nothing: list every such policy on "' +
+        finding.table + '" and narrow or drop the loose one. Keep the read rule as it is if a "' +
+        finding.who + '" should still see these rows.',
+      '',
+      'Then check every other table where members can write for the same thing.',
+    ]
+    : finding.kind === 'bucket'
+    ? [
+      'My app may have a storage problem - please check it rather than assume it.',
+      '',
+      'The Supabase Storage bucket "' + finding.bucket + '" is public. Anyone with a file\'s URL can ' +
+        'download it without logging in, and the storage.objects ' +
+        ((finding.rules || []).length === 1 ? 'policy that names' : 'policies that name') + ' this bucket (' +
+        listOf((finding.rules || []).map((r) => '"' + r + '"')) + ') ' +
+        ((finding.rules || []).length === 1 ? 'is' : 'are') + ' not checked for public URLs - so ' +
+        ((finding.rules || []).length === 1 ? 'it protects' : 'they protect') + ' nothing while it is public.',
+      '',
+      'First tell me: is every file in this bucket meant to be downloadable by anyone? If yes, change nothing.',
+      '',
+      'If not, make the bucket private (in the Supabase dashboard: Storage, edit the bucket, turn Public ' +
+        'off - or UPDATE storage.buckets SET public = false WHERE id = \'' + finding.bucket + '\'). Then ' +
+        'change the app to fetch these files with signed URLs (createSignedUrl) instead of getPublicUrl, ' +
+        'or the links it shows will stop working.',
+      '',
+      'Keep the read rule: once the bucket is private it is what decides who gets a file. Check that it ' +
+        'only lets in the right people.',
+      '',
+      'Then look at every other bucket for the same thing.',
+    ]
     : finding.kind === 'privileged'
     ? [
       'My app may have a security problem - please check it rather than assume it.',
@@ -851,6 +956,10 @@ function fixPromptFor(finding) {
     .join('\n');
 }
 
+// Found and said, but never claimed as a break: the owner decides. Counted
+// apart in the report, never towards the exit code or a clean re-check.
+const TO_CHECK = ['privileged', 'role', 'bucket'];
+
 /** Everything the report needs about one thing the attack found. */
 function describe(finding) {
   const contents = readContents(finding.columns);
@@ -861,7 +970,7 @@ function describe(finding) {
     // one the tool reasons about without executing, so it says so. The report
     // and the re-check both read this: a "verification required" finding is
     // never counted towards a clean re-check on its own.
-    status: finding.kind === 'privileged' ? 'verification required' : 'confirmed',
+    status: TO_CHECK.includes(finding.kind) ? 'verification required' : 'confirmed',
     table: finding.kind === 'privileged' ? finding.fn : finding.table,
     fn: finding.fn,
     args: finding.args,
@@ -880,14 +989,26 @@ function describe(finding) {
     // For a privileged function there is no "why the door is open" the way a
     // table has one; the body already carries the whole explanation, so the
     // cause line would only repeat it. Left empty and skipped by the report.
-    cause: finding.kind === 'privileged' ? '' : cause.long,
+    cause: TO_CHECK.includes(finding.kind) ? '' : cause.long,
     who: finding.who,
     can: finding.can,
+    via: finding.via,
+    roleColumn: finding.roleColumn,
+    bucket: finding.bucket,
     proof: finding.kind === 'recursive'
       ? 'Using ' + listOf((finding.reads || []).map((t) => '"' + t + '"')) + ' stopped with ' +
-        '"infinite recursion detected in policy for relation ' + finding.table + '".'
+        loopError(finding) + '.'
       : finding.kind === 'privileged'
       ? 'I did not call "' + finding.fn + '". This is a reach that exists in the grants, not a break I ran.'
+      : finding.kind === 'role'
+      ? 'As a "' + finding.who + '" who had just joined, I ' +
+        listOf((finding.can || []).map((what) => {
+          const n = (finding.changed || {})[what] || 1;
+          return (what === 'change' ? 'changed ' : 'deleted ') + n + (n === 1 ? ' row' : ' rows');
+        })) + ' in "' + finding.table + '" that I could not touch before joining. All of it was undone.'
+      : finding.kind === 'bucket'
+      ? 'I read that "' + finding.bucket + '" is public and that ' + listOf((finding.rules || []).map((r) => '"' + r + '"')) +
+        ' says who may read it. I did not open any file.'
       : finding.kind === 'duplicated'
       ? 'I created ' + finding.copies + ' rows in "' + finding.table + '" holding the same ' +
         finding.column + '.'
@@ -992,7 +1113,7 @@ function describeAll(findings) {
   // Writes above reads: a table somebody emptied is worse than one they read.
   // A looping rule sits with the reads: it breaks the app for everyone it
   // fails for, which matters more than a duplicate or a stray row.
-  const byKind = { writable: 0, exposed: 1, crossed: 2, recursive: 2.5, duplicated: 3, orphaned: 4, privileged: 5 };
+  const byKind = { writable: 0, exposed: 1, crossed: 2, recursive: 2.5, duplicated: 3, orphaned: 4, role: 4.5, bucket: 4.7, privileged: 5 };
   const rank = (d) => (d.severity === 'CRITICAL' ? 0 : 1) * 10 + (byKind[d.kind] === undefined ? 9 : byKind[d.kind]);
   return described.sort((a, b) => rank(a) - rank(b));
 }

package/intro.js

@@ -78,6 +78,9 @@ function consentLines(target) {
     '  - Look at the shape of your "' + target + '" tables: their names, their',
     '    columns, and the rules about who is allowed to see what.',
     '',
+    '  - Look at your file storage settings: which buckets are public, and',
+    '    the rules about who may open their files. Never a file itself.',
+    '',
     '  - Make one new temporary space inside your database and rebuild that',
     '    same shape in it. Your real tables are not changed.',
     '',
@@ -91,7 +94,8 @@ function consentLines(target) {
     'What I will not do:',
     '',
     '  - I do not read your real data. Not one customer, order or message.',
-    '    Every row I read is a row I put there myself a moment earlier.',
+    '    Apart from the storage settings above, every row I read is a row I',
+    '    put there myself a moment earlier.',
     '',
     '  - I do not change your real tables. Only the temporary copy.',
     '',

package/orphan.js

@@ -40,43 +40,11 @@ const attack = require('./attack.js');
 // an audit row is the feature.
 const KEEPS_HISTORY = /(^|_)(log|logs|audit|audits|event|events|history|archive|archives|snapshot|snapshots|activity|activities)(_|$)/i;
 
-/** The single-column primary key of a table, or null if it has none. */
-function primaryKeyOf(table) {
-  for (const constraint of table.constraints || []) {
-    if (constraint.kind !== 'p') continue;
-    const match = /PRIMARY KEY \(([^)]+)\)/i.exec(constraint.definition);
-    if (!match) continue;
-    const columns = match[1].split(',').map((name) => name.trim().split('"').join(''));
-    // A composite key is not something a single `<thing>_id` column points at.
-    return columns.length === 1 ? columns[0] : null;
-  }
-  return null;
-}
-
-/**
- * The table a column named `<thing>_id` is pointing at, if there is one.
- *
- * The name has to match a table that is really here, and the types have to
- * agree. Both, because `stripe_id` matches nothing and `org_id integer` does
- * not point at an `orgs.id` that is a uuid.
- */
-function parentFor(column, tables) {
-  const stem = /^(.+)_id$/i.exec(column.name);
-  if (!stem) return null;
-  const wanted = stem[1].toLowerCase();
-  const parent = (tables || []).find((table) => {
-    const name = table.name.toLowerCase();
-    return name === wanted || name === wanted + 's' || name === wanted + 'es';
-  });
-  if (!parent) return null;
-
-  const key = primaryKeyOf(parent);
-  if (!key) return null;
-  const keyColumn = (parent.columns || []).find((c) => c.name === key);
-  if (!keyColumn || keyColumn.type !== column.type) return null;
-
-  return { table: parent, keyColumn: key, type: keyColumn.type };
-}
+// Which table a `<thing>_id` column points at is decided in attack.js, because
+// the seeder needs the same answer: a row has to point at a parent that is
+// really there, whether or not a key says so.
+const primaryKeyOf = attack.primaryKeyOf;
+const parentFor = attack.parentFor;
 
 /** Is this column already held down by a foreign key? */
 function alreadyTied(table, columnName) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kryptheon-night",
-  "version": "0.1.22",
+  "version": "0.1.26",
   "description": "Attacks a copy of your Supabase database and tells you in plain English what got in.",
   "license": "MIT",
   "type": "commonjs",
@@ -31,7 +31,7 @@
     "node": ">=18.0.0"
   },
   "scripts": {
-    "check": "node package.check.js && node store.check.js && node trouble.check.js && node intro.check.js && node finding.check.js && node outside.check.js && node recheck.check.js && node untouched.check.js && node blocked.check.js && node orphans.check.js && node guests.check.js && node usable.check.js && node twin.check.js && node engines.check.js && node external.check.js && node schema.check.js && node collision.check.js && node tamper.check.js && node orphan.check.js && node shapes.check.js && node verdicts.check.js && node shop.check.js && node privileged.check.js && node recursion.check.js && node guarded.check.js && node nightly.check.js && node words.check.js && node cli.check.js && node loop.check.js",
+    "check": "node package.check.js && node store.check.js && node trouble.check.js && node intro.check.js && node finding.check.js && node outside.check.js && node recheck.check.js && node untouched.check.js && node blocked.check.js && node orphans.check.js && node guests.check.js && node usable.check.js && node twin.check.js && node engines.check.js && node external.check.js && node schema.check.js && node collision.check.js && node tamper.check.js && node orphan.check.js && node shapes.check.js && node verdicts.check.js && node shop.check.js && node privileged.check.js && node recursion.check.js && node guarded.check.js && node nightly.check.js && node words.check.js && node helpers.check.js && node deeploop.check.js && node teams.check.js && node roles.check.js && node buckets.check.js && node cli.check.js && node loop.check.js",
     "check:dry": "node package.check.js && node store.check.js && node trouble.check.js && node intro.check.js && node finding.check.js && node recheck.check.js && node outside.check.js",
     "check:package": "node package.check.js",
     "check:store": "node store.check.js",
@@ -57,6 +57,9 @@
     "check:guarded": "node guarded.check.js",
     "check:nightly": "node nightly.check.js",
     "check:words": "node words.check.js",
+    "check:helpers": "node helpers.check.js",
+    "check:deeploop": "node deeploop.check.js",
+    "check:teams": "node teams.check.js",
     "check:cli": "node cli.check.js",
     "check:writes": "node tamper.check.js",
     "check:orphans": "node orphans.check.js",
@@ -68,7 +71,9 @@
     "check:twin": "node twin.check.js",
     "prepublishOnly": "node package.check.js",
     "check:engines": "node engines.check.js",
-    "check:installer": "node installer.check.js"
+    "check:installer": "node installer.check.js",
+    "check:roles": "node roles.check.js",
+    "check:buckets": "node buckets.check.js"
   },
   "keywords": [
     "supabase",

package/recheck.js

@@ -172,6 +172,8 @@ function whatOf(item) {
   if (item.kind === 'duplicated') return 'the same ' + (item.column || 'value') + ' twice';
   if (item.kind === 'orphaned') return 'rows left pointing at nothing';
   if (item.kind === 'privileged') return 'a function anyone can call';
+  if (item.kind === 'role') return 'changed by a "' + (item.who || 'viewer') + '"';
+  if (item.kind === 'bucket') return 'a public storage bucket';
   if (item.kind === 'recursive') return 'a rule that refers to itself';
   return item.kind;
 }
@@ -196,6 +198,8 @@ function describe(result) {
       // was seen, not as an attack that was refused. Found on a fix test.
       const how = item.kind === 'privileged'
         ? 'I looked again, and a visitor with no account can no longer call it.'
+        : item.kind === 'bucket'
+        ? 'I looked again, and the bucket is no longer public.'
         : item.kind === 'recursive'
         ? 'I read it again, and its rules answered instead of stopping with an error.'
         : 'I ran the same attack again and it was refused.';

package/scan.js

@@ -128,7 +128,7 @@ function suggest(schemas) {
 }
 
 /**
- * The engine, as six operations, so the scan does not know which one it has.
+ * The engine, as seven operations, so the scan does not know which one it has.
  *
  * `scan.js` named `schema.js`, `attack.js`, `tamper.js` and `orphan.js`
  * directly, which meant the SQL engine could only ever be reached by the twin
@@ -153,6 +153,7 @@ function nodeEngine() {
     tamper: (client, into, tables, seeded, policies) =>
       tamper.tamper(client, into, tables, seeded, policies),
     orphan: (client, into, tables, seeded) => orphan.orphan(client, into, tables, seeded),
+    teammate: (client, into, tables, seeded) => tamper.teammate(client, into, tables, seeded),
   };
 }
 
@@ -302,6 +303,14 @@ async function scan(client, sourceSchema, options) {
       notChecked.push({ table: stuck.table, key: stuck.key, why: stuck.why });
     }
 
+    // What the least trusted member of a team can change there. Rolled back
+    // like the writes above, and the joining with them.
+    const ranked = await engine.teammate(client, copyName, theirs, sown.seeded);
+    for (const key of ranked.completed) attempted.push(key);
+    for (const stuck of ranked.blocked) {
+      notChecked.push({ table: stuck.table, key: stuck.key, why: stuck.why });
+    }
+
     // Can a half-finished write survive? Rolled back like the writes above.
     say('  Looking for rows that could point at nothing ...');
     const stranded = await engine.orphan(client, copyName, theirs, sown.seeded);
@@ -320,16 +329,24 @@ async function scan(client, sourceSchema, options) {
     // app is broken for the people using it. One finding per table at fault,
     // named from Postgres's own message, however many reads ran into it.
     const loops = new Map();
+    // A loop that named no table ("stack depth limit exceeded") is put on the
+    // tables whose own rule calls a helper that reads that same table; if
+    // none can be found, on the table that was being read.
+    const culprits = loopingTables(copyPlan);
     const loopedInto = (relation, table, who) => {
-      if (!loops.has(relation)) loops.set(relation, { kind: 'recursive', table: relation, reads: [], callers: [], columns: [] });
-      const entry = loops.get(relation);
-      if (!entry.reads.includes(table)) entry.reads.push(table);
-      if (!entry.callers.includes(who)) entry.callers.push(who);
+      const deep = !relation;
+      for (const at of relation ? [relation] : culprits.length ? culprits : [table]) {
+        if (!loops.has(at)) loops.set(at, { kind: 'recursive', table: at, reads: [], callers: [], columns: [], deep: false });
+        const entry = loops.get(at);
+        if (deep) entry.deep = true;
+        if (!entry.reads.includes(table)) entry.reads.push(table);
+        if (!entry.callers.includes(who)) entry.callers.push(who);
+      }
     };
     for (const hit of impersonation.looped || []) loopedInto(hit.relation, hit.table, hit.who);
     for (const stuck of writes.blocked) {
       const relation = attack.recursionIn(stuck.why);
-      if (relation) loopedInto(relation, stuck.table, /^as anyone:/.test(stuck.why) ? 'anyone' : 'signed-in');
+      if (relation || attack.tooDeep(stuck.why)) loopedInto(relation || null, stuck.table, /^as anyone:/.test(stuck.why) ? 'anyone' : 'signed-in');
     }
     const recursive = Array.from(loops.values());
 
@@ -387,6 +404,13 @@ async function scan(client, sourceSchema, options) {
     for (const fn of plan.anonFunctions || []) attempted.push('privileged:' + fn.name);
     const privileged = privilegedOf(plan);
 
+    // Storage buckets switched to public that also have a rule saying who may
+    // read them. Read from the bucket settings and the rules, never a file.
+    // Every bucket read counts as examined, so one made private comes back
+    // from a re-check as fixed.
+    for (const bucket of plan.buckets || []) attempted.push('bucket:' + bucket.name);
+    const buckets = bucketsOf(plan);
+
     // Ties read from the original schema: the copy points auth.users keys at
     // a stand-in, and would call every table untied. Owners read from the
     // copy, the way seeding did.
@@ -398,7 +422,7 @@ async function scan(client, sourceSchema, options) {
       notChecked: notChecked,
       attempted: attempted,
       findings: finding.describeAll(
-        impersonation.findings.concat(writes.findings, stranded.findings, raced, privileged, recursive).map(tagged),
+        impersonation.findings.concat(writes.findings, ranked.findings, stranded.findings, raced, privileged, buckets, recursive).map(tagged),
       ),
     };
   } finally {
@@ -422,6 +446,36 @@ function exitCodeFor(result) {
   return (result.findings || []).some((f) => f.status !== 'verification required') ? 1 : 0;
 }
 
+/**
+ * The tables whose own rule reaches back into the same table through the
+ * helpers it calls - directly or through helpers those call. Such a rule has
+ * to be evaluated to be evaluated, which is how "stack depth limit exceeded"
+ * happens; the message itself does not say which table.
+ */
+function loopingTables(plan) {
+  const escape = (x) => x.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+  const calls = (text, name) => new RegExp('(^|[^A-Za-z0-9_$])"?' + escape(name) + '"?\\s*\\(').test(String(text || ''));
+  const mentions = (text, name) => new RegExp('(^|[^A-Za-z0-9_$])"?' + escape(name) + '"?([^A-Za-z0-9_$]|$)').test(String(text || ''));
+  const fns = (plan && plan.functions) || [];
+  const reached = (text) => {
+    const found = new Set(fns.filter((f) => calls(text, f.name)).map((f) => f.name));
+    let grew = true;
+    while (grew) {
+      grew = false;
+      for (const f of fns) {
+        if (found.has(f.name)) continue;
+        if (fns.some((g) => found.has(g.name) && calls(g.src, f.name))) { found.add(f.name); grew = true; }
+      }
+    }
+    return fns.filter((f) => found.has(f.name));
+  };
+  return ((plan && plan.tables) || []).map((t) => t.name).filter((name) => {
+    const rules = ((plan && plan.policies) || []).filter((p) => p.table_name === name)
+      .map((p) => String(p.qual || '') + ' ' + String(p.with_check || '')).join(' ');
+    return rules.trim() && reached(rules).some((f) => mentions(f.src, name));
+  });
+}
+
 /**
  * Functions an anonymous visitor can call that run past the rules. Read from
  * the shape, not attacked. Quiet: a yes/no about the caller, and a function
@@ -439,6 +493,37 @@ function privilegedOf(plan) {
   }));
 }
 
+/**
+ * A public bucket whose read rule says it was meant to be private.
+ *
+ * Found on two blind tests (OrbitDesk, AtlasPay): a bucket of exports and one
+ * of settlement evidence were switched to public. A public bucket hands any
+ * file to whoever has its link, and the rules on storage.objects are not asked.
+ * A rule that only lets in some people is how the app says the files are not
+ * for everyone - so a public bucket with one is worth a look. A rule that lets
+ * in everyone anyway (anon or public, and nothing but the bucket's name) says
+ * the opposite, and is not reported.
+ */
+function bucketsOf(plan) {
+  const escape = (x) => String(x).replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+  const narrows = (rule, id) => {
+    const roles = schema.roleList(rule.roles);
+    const toEveryone = roles.includes('anon') || roles.includes('public');
+    const rest = String(rule.qual || '')
+      .replace(new RegExp("bucket_id\\s*=\\s*'" + escape(id) + "'(::text)?", 'gi'), '')
+      .replace(new RegExp("'" + escape(id) + "'(::text)?\\s*=\\s*bucket_id", 'gi'), '')
+      .replace(/\btrue\b|\band\b|[()\s]/gi, '');
+    return !toEveryone || rest !== '';
+  };
+  return ((plan && plan.buckets) || []).filter((b) => b.public).map((b) => ({
+    kind: 'bucket',
+    table: b.name,
+    bucket: b.id,
+    rules: (b.readRules || []).filter((rule) => narrows(rule, b.id)).map((rule) => rule.name),
+    columns: [],
+  })).filter((f) => f.rules.length);
+}
+
 /**
  * What each finding needs to know about its table for its fix to be right:
  * whether the app signs people in through Supabase, whether a row says whose
@@ -521,8 +606,15 @@ function nightlyRecord(latest, readAt, plan) {
   // functions anyone can call - read now, when this is asked, because the
   // engine inside the database does not look at them.
   const tag = plan ? taggerFor(plan, plan.tables) : (f) => f;
-  const night = (run.findings || []).map((f) => tag(Object.assign({}, f, { fromNight: true })));
-  const now = plan ? privilegedOf(plan).map(tag) : [];
+  // A loop the engine could not name ("stack depth limit exceeded") is put
+  // on the tables whose own rule reads back into them, read from the shape.
+  const loops = plan ? loopingTables(plan) : [];
+  const night = [];
+  for (const f of run.findings || []) {
+    const at = f.kind === 'recursive' && !f.table ? (loops.length ? loops : ['one of your tables']) : [f.table];
+    for (const table of at) night.push(tag(Object.assign({}, f, { table: table, fromNight: true })));
+  }
+  const now = plan ? privilegedOf(plan).concat(bucketsOf(plan)).map(tag) : [];
   return Object.assign(record, {
     ranAt: at(run.ran_at),
     source: run.source,
@@ -692,8 +784,14 @@ function report(result) {
     line('  ' + confirmed.length + (confirmed.length === 1 ? ' problem' : ' problems') + ' found.');
   }
   if (toVerify.length) {
-    line('  ' + toVerify.length + ' thing' + (toVerify.length === 1 ? '' : 's') +
-      ' to check - I did not attack ' + (toVerify.length === 1 ? 'it' : 'them') + ', only spotted the risk.');
+    // A viewer who can edit was really tried; a function or a bucket was only
+    // read. Either way it is the owner's call, and the line says which.
+    const tried = toVerify.some((f) => f.kind === 'role');
+    const spotted = toVerify.some((f) => f.kind !== 'role');
+    const it = toVerify.length === 1 ? 'it' : 'them';
+    line('  ' + toVerify.length + ' thing' + (toVerify.length === 1 ? '' : 's') + ' to check - ' +
+      (spotted && !tried ? 'I did not attack ' + it + ', only spotted the risk.'
+        : 'whether ' + (toVerify.length === 1 ? 'it is a problem' : 'each is a problem') + ' is your decision.'));
   }
 
   for (const item of result.findings) {
@@ -842,6 +940,8 @@ module.exports = {
   scheduleTimes: scheduleTimes,
   notCheckedFromNight: notCheckedFromNight,
   privilegedOf: privilegedOf,
+  bucketsOf: bucketsOf,
+  loopingTables: loopingTables,
   taggerFor: taggerFor,
   saveNightly: saveNightly,
   sweepOldCopies: sweepOldCopies,