kryptheon-night 0.1.25 → 0.1.27

package/finding.js

@@ -88,6 +88,17 @@ function listOf(items) {
   return list.slice(0, -1).join(', ') + ' and ' + list[list.length - 1];
 }
 
+/** One of a table's things: workspaces -> workspace, companies -> company. */
+/** The same, with its article: a workspace, an organization. */
+function aOne(table) {
+  const one = oneOf(table);
+  return (/^[aeiou]/i.test(one) ? 'an ' : 'a ') + one;
+}
+
+function oneOf(table) {
+  return String(table || 'team').replace(/ies$/, 'y').replace(/s$/, '');
+}
+
 /* --------------------------------------------------------------------------
    How bad it is.
 -------------------------------------------------------------------------- */
@@ -105,6 +116,11 @@ function severityOf(finding, contents) {
     // because the app is broken for whoever it fails for, but not a break-in.
     return 'HIGH';
   }
+  if (finding.kind === 'role' || finding.kind === 'teamread' || finding.kind === 'bucket') {
+    // Something to check, never a confirmed break: whether a viewer may edit,
+    // or a bucket may be public, is the owner's decision. So never CRITICAL.
+    return 'HIGH';
+  }
   if (finding.kind === 'privileged') {
     // Not proven, so never CRITICAL: this is a reach that exists, not a break
     // that was demonstrated. A function anon can call that also writes is worth
@@ -332,6 +348,19 @@ function headlineFor(finding) {
   if (finding.kind === 'privileged') {
     return 'Anyone on the internet can call your ' + finding.fn + ' function, and it runs with full rights.';
   }
+  if (finding.kind === 'role') {
+    const order = ['delete', 'change', 'add'];
+    const does = order.filter((what) => (finding.can || []).includes(what)).map((what) => WRITE_WORDS[what]);
+    return 'A "' + finding.who + '" in ' + aOne(finding.parent) + ' can ' + listOf(does) + ' your ' +
+      finding.table + ' table.';
+  }
+  if (finding.kind === 'teamread') {
+    return 'A "' + finding.who + '" in ' + aOne(finding.parent) + ' can read your ' + finding.table +
+      ' table, which holds ' + listOf(finding.secrets || []) + '.';
+  }
+  if (finding.kind === 'bucket') {
+    return 'Your ' + finding.table + ' storage bucket is public, but a rule says only some people may read it.';
+  }
   if (finding.kind === 'exposed') {
     return 'Your ' + finding.table + ' ' + (finding.isView ? 'view' : 'table') + ' can be read by anyone.';
   }
@@ -415,6 +444,53 @@ function bodyFor(finding, contents) {
       'kept, and your live app was never touched.';
   }
 
+  if (finding.kind === 'role') {
+    // Said as what was done, and then whose decision it is: a viewer who may
+    // edit is a hole in one app and the design of another.
+    const did = [];
+    const rows = (n) => n + (n === 1 ? ' row' : ' rows');
+    if ((finding.can || []).includes('add')) did.push('added ' + rows((finding.changed || {}).add || 1));
+    if ((finding.can || []).includes('change')) did.push('changed ' + rows((finding.changed || {}).change || 1));
+    if ((finding.can || []).includes('delete')) did.push('deleted ' + rows((finding.changed || {}).delete || 1));
+    const place = oneOf(finding.parent);
+    return (
+      'I put one of my fake people into the other one\'s ' + place + ' as a "' + finding.who +
+      '" - the lowest role in ' + finding.via + '.' + finding.roleColumn + ' - and, signed in as them, I ' +
+      listOf(did) + ' in ' + finding.table + ' for that ' + place + ', on a copy of your app. ' +
+      'Before joining, they could not. Every one of those was undone straight away. Whether a "' + finding.who +
+      '" may do this is your decision: if it is meant to, nothing needs fixing; if a "' + finding.who +
+      '" should only look, the rules on this table let them do more.'
+    );
+  }
+
+  if (finding.kind === 'teamread') {
+    // Said as what was read and by whom, and which roles below it could not:
+    // a dispatcher seeing a key may be the design, a viewer rarely is.
+    const place = oneOf(finding.parent);
+    const n = finding.readable || 1;
+    const below = (finding.below || []).map((r) => '"' + r + '"');
+    return (
+      'I put one of my fake people into the other one\'s ' + place + ' as a "' + finding.who + '" and, signed ' +
+      'in as them, read ' + n + (n === 1 ? ' row' : ' rows') + ' of ' + finding.table + ' for that ' + place +
+      ', on a copy of your app - including ' + listOf(finding.secrets || []) + '. Before joining, they could not.' +
+      (below.length ? ' As ' + listOf(below).replace(/ and /, ' or ') + ' they could not read it either.' : '') +
+      ' Nothing was changed. Whether a "' + finding.who + '" should see these is your decision: if not, a read ' +
+      'rule on this table lets them.'
+    );
+  }
+
+  if (finding.kind === 'bucket') {
+    // Said as what was read, never as a file taken: no file was opened.
+    return (
+      'In Supabase Storage the bucket "' + finding.bucket + '" is set to public, so anyone with a ' +
+      'file\'s link can download it without logging in - the rules on storage.objects are not asked. ' +
+      'You also wrote ' + ((finding.rules || []).length === 1 ? 'a rule' : 'rules') + ' saying who may read it (' +
+      listOf(finding.rules || []) + '), so it was probably meant to be private. I only read the ' +
+      'bucket\'s setting and its rules; I did not open or list any file. Whether it should be public ' +
+      'is yours to say.'
+    );
+  }
+
   if (finding.kind === 'privileged') {
     // Said as what is true, not as what was done - nothing was executed. The
     // reach is real; whether it is a mistake is the person's to say, so the
@@ -694,6 +770,69 @@ function fixPromptFor(finding) {
       'Then sign in as an ordinary user and open the pages that use these tables, and run this ' +
         'check again - the tables it could not test will be tested this time.',
     ]
+    : finding.kind === 'role'
+    ? [
+      'My app may have a permissions problem - please check it rather than assume it.',
+      '',
+      'In my database, a member of ' + aOne(finding.parent) + ' whose role in "' + finding.via + '"."' +
+        finding.roleColumn + '" is "' + finding.who + '" can ' +
+        listOf((finding.can || []).map((what) => ({ add: 'add', change: 'change', delete: 'delete' })[what])) +
+        ' rows of that ' + oneOf(finding.parent) + ' in the "' + finding.table + '" table. This was proved ' +
+        'on a copy of the database: a "' + finding.who + '" was added, and the writes went through.',
+      '',
+      'First tell me: should a "' + finding.who + '" be able to do that? If yes, change nothing.',
+      '',
+      'If not, make the rules on "' + finding.table + '" that cover UPDATE, DELETE, INSERT or ALL check ' +
+        'the member\'s role as well as membership - for example with a helper that reads "' + finding.via +
+        '" for auth.uid() and the roles allowed to edit. Postgres lets a write through if ANY permissive ' +
+        'policy allows it, so a strict rule beside a loose one does nothing: list every such policy on "' +
+        finding.table + '" and narrow or drop the loose one. Keep the read rule as it is if a "' +
+        finding.who + '" should still see these rows.',
+      '',
+      'Then check every other table where members can write for the same thing.',
+    ]
+    : finding.kind === 'teamread'
+    ? [
+      'My app may have a permissions problem - please check it rather than assume it.',
+      '',
+      'In my database, a member of ' + aOne(finding.parent) + ' whose role in "' + finding.via + '"."' +
+        finding.roleColumn + '" is "' + finding.who + '" can read the "' + finding.table + '" table of that ' +
+        oneOf(finding.parent) + ', including ' + listOf((finding.secrets || []).map((c) => '"' + c + '"')) +
+        '. This was proved on a copy of the database: a "' + finding.who + '" was added, and the rows came back.',
+      '',
+      'First tell me: should a "' + finding.who + '" see these? If yes, change nothing.',
+      '',
+      'If not, make the rules on "' + finding.table + '" that cover SELECT or ALL check the member\'s role as ' +
+        'well as membership. Postgres lets a read through if ANY permissive policy allows it, so a strict rule ' +
+        'beside a loose one does nothing: list every such policy on "' + finding.table + '" and narrow or drop ' +
+        'the loose one. If members need the other columns, a view or function that leaves the secret ones out ' +
+        'is often the better fix.',
+      '',
+      'Then check every other table that holds tokens, keys, secrets or payloads for the same thing.',
+    ]
+    : finding.kind === 'bucket'
+    ? [
+      'My app may have a storage problem - please check it rather than assume it.',
+      '',
+      'The Supabase Storage bucket "' + finding.bucket + '" is public. Anyone with a file\'s URL can ' +
+        'download it without logging in, and the storage.objects ' +
+        ((finding.rules || []).length === 1 ? 'policy that names' : 'policies that name') + ' this bucket (' +
+        listOf((finding.rules || []).map((r) => '"' + r + '"')) + ') ' +
+        ((finding.rules || []).length === 1 ? 'is' : 'are') + ' not checked for public URLs - so ' +
+        ((finding.rules || []).length === 1 ? 'it protects' : 'they protect') + ' nothing while it is public.',
+      '',
+      'First tell me: is every file in this bucket meant to be downloadable by anyone? If yes, change nothing.',
+      '',
+      'If not, make the bucket private (in the Supabase dashboard: Storage, edit the bucket, turn Public ' +
+        'off - or UPDATE storage.buckets SET public = false WHERE id = \'' + finding.bucket + '\'). Then ' +
+        'change the app to fetch these files with signed URLs (createSignedUrl) instead of getPublicUrl, ' +
+        'or the links it shows will stop working.',
+      '',
+      'Keep the read rule: once the bucket is private it is what decides who gets a file. Check that it ' +
+        'only lets in the right people.',
+      '',
+      'Then look at every other bucket for the same thing.',
+    ]
     : finding.kind === 'privileged'
     ? [
       'My app may have a security problem - please check it rather than assume it.',
@@ -863,6 +1002,10 @@ function fixPromptFor(finding) {
     .join('\n');
 }
 
+// Found and said, but never claimed as a break: the owner decides. Counted
+// apart in the report, never towards the exit code or a clean re-check.
+const TO_CHECK = ['privileged', 'role', 'teamread', 'bucket'];
+
 /** Everything the report needs about one thing the attack found. */
 function describe(finding) {
   const contents = readContents(finding.columns);
@@ -873,7 +1016,7 @@ function describe(finding) {
     // one the tool reasons about without executing, so it says so. The report
     // and the re-check both read this: a "verification required" finding is
     // never counted towards a clean re-check on its own.
-    status: finding.kind === 'privileged' ? 'verification required' : 'confirmed',
+    status: TO_CHECK.includes(finding.kind) ? 'verification required' : 'confirmed',
     table: finding.kind === 'privileged' ? finding.fn : finding.table,
     fn: finding.fn,
     args: finding.args,
@@ -892,14 +1035,31 @@ function describe(finding) {
     // For a privileged function there is no "why the door is open" the way a
     // table has one; the body already carries the whole explanation, so the
     // cause line would only repeat it. Left empty and skipped by the report.
-    cause: finding.kind === 'privileged' ? '' : cause.long,
+    cause: TO_CHECK.includes(finding.kind) ? '' : cause.long,
     who: finding.who,
     can: finding.can,
+    via: finding.via,
+    roleColumn: finding.roleColumn,
+    readable: finding.readable,
+    secrets: finding.secrets,
+    bucket: finding.bucket,
     proof: finding.kind === 'recursive'
       ? 'Using ' + listOf((finding.reads || []).map((t) => '"' + t + '"')) + ' stopped with ' +
         loopError(finding) + '.'
       : finding.kind === 'privileged'
       ? 'I did not call "' + finding.fn + '". This is a reach that exists in the grants, not a break I ran.'
+      : finding.kind === 'role'
+      ? 'As a "' + finding.who + '" who had just joined, I ' +
+        listOf((finding.can || []).map((what) => {
+          const n = (finding.changed || {})[what] || 1;
+          return ({ add: 'added ', change: 'changed ', delete: 'deleted ' })[what] + n + (n === 1 ? ' row' : ' rows');
+        })) + ' in "' + finding.table + '" that I could not touch before joining. All of it was undone.'
+      : finding.kind === 'teamread'
+      ? 'As a "' + finding.who + '" who had just joined, I read ' + (finding.readable || 1) +
+        ((finding.readable || 1) === 1 ? ' row' : ' rows') + ' of "' + finding.table + '" that I could not read before joining.'
+      : finding.kind === 'bucket'
+      ? 'I read that "' + finding.bucket + '" is public and that ' + listOf((finding.rules || []).map((r) => '"' + r + '"')) +
+        ' says who may read it. I did not open any file.'
       : finding.kind === 'duplicated'
       ? 'I created ' + finding.copies + ' rows in "' + finding.table + '" holding the same ' +
         finding.column + '.'
@@ -1004,7 +1164,7 @@ function describeAll(findings) {
   // Writes above reads: a table somebody emptied is worse than one they read.
   // A looping rule sits with the reads: it breaks the app for everyone it
   // fails for, which matters more than a duplicate or a stray row.
-  const byKind = { writable: 0, exposed: 1, crossed: 2, recursive: 2.5, duplicated: 3, orphaned: 4, privileged: 5 };
+  const byKind = { writable: 0, exposed: 1, crossed: 2, recursive: 2.5, duplicated: 3, orphaned: 4, role: 4.5, teamread: 4.6, bucket: 4.7, privileged: 5 };
   const rank = (d) => (d.severity === 'CRITICAL' ? 0 : 1) * 10 + (byKind[d.kind] === undefined ? 9 : byKind[d.kind]);
   return described.sort((a, b) => rank(a) - rank(b));
 }

package/intro.js

@@ -78,6 +78,9 @@ function consentLines(target) {
     '  - Look at the shape of your "' + target + '" tables: their names, their',
     '    columns, and the rules about who is allowed to see what.',
     '',
+    '  - Look at your file storage settings: which buckets are public, and',
+    '    the rules about who may open their files. Never a file itself.',
+    '',
     '  - Make one new temporary space inside your database and rebuild that',
     '    same shape in it. Your real tables are not changed.',
     '',
@@ -91,7 +94,8 @@ function consentLines(target) {
     'What I will not do:',
     '',
     '  - I do not read your real data. Not one customer, order or message.',
-    '    Every row I read is a row I put there myself a moment earlier.',
+    '    Apart from the storage settings above, every row I read is a row I',
+    '    put there myself a moment earlier.',
     '',
     '  - I do not change your real tables. Only the temporary copy.',
     '',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kryptheon-night",
-  "version": "0.1.25",
+  "version": "0.1.27",
   "description": "Attacks a copy of your Supabase database and tells you in plain English what got in.",
   "license": "MIT",
   "type": "commonjs",
@@ -31,7 +31,7 @@
     "node": ">=18.0.0"
   },
   "scripts": {
-    "check": "node package.check.js && node store.check.js && node trouble.check.js && node intro.check.js && node finding.check.js && node outside.check.js && node recheck.check.js && node untouched.check.js && node blocked.check.js && node orphans.check.js && node guests.check.js && node usable.check.js && node twin.check.js && node engines.check.js && node external.check.js && node schema.check.js && node collision.check.js && node tamper.check.js && node orphan.check.js && node shapes.check.js && node verdicts.check.js && node shop.check.js && node privileged.check.js && node recursion.check.js && node guarded.check.js && node nightly.check.js && node words.check.js && node helpers.check.js && node deeploop.check.js && node teams.check.js && node cli.check.js && node loop.check.js",
+    "check": "node package.check.js && node store.check.js && node trouble.check.js && node intro.check.js && node finding.check.js && node outside.check.js && node recheck.check.js && node untouched.check.js && node blocked.check.js && node orphans.check.js && node guests.check.js && node usable.check.js && node twin.check.js && node engines.check.js && node external.check.js && node schema.check.js && node collision.check.js && node tamper.check.js && node orphan.check.js && node shapes.check.js && node verdicts.check.js && node shop.check.js && node privileged.check.js && node recursion.check.js && node guarded.check.js && node nightly.check.js && node words.check.js && node helpers.check.js && node deeploop.check.js && node teams.check.js && node roles.check.js && node buckets.check.js && node cli.check.js && node loop.check.js",
     "check:dry": "node package.check.js && node store.check.js && node trouble.check.js && node intro.check.js && node finding.check.js && node recheck.check.js && node outside.check.js",
     "check:package": "node package.check.js",
     "check:store": "node store.check.js",
@@ -71,7 +71,9 @@
     "check:twin": "node twin.check.js",
     "prepublishOnly": "node package.check.js",
     "check:engines": "node engines.check.js",
-    "check:installer": "node installer.check.js"
+    "check:installer": "node installer.check.js",
+    "check:roles": "node roles.check.js",
+    "check:buckets": "node buckets.check.js"
   },
   "keywords": [
     "supabase",

package/recheck.js

@@ -53,6 +53,53 @@ function proofsOf(list) {
   return (list || []).reduce((all, item) => all.concat(item.members && item.members.length ? item.members : [item]), []);
 }
 
+/*
+ * Whether the earlier run was on this database at all.
+ *
+ * Found on a blind test (HelixOps): the repository's database was scanned,
+ * then the production one from the same folder, and the re-check reported the
+ * six differences as "NEW problems" and said "A fix can open something else".
+ * Nothing had been fixed; it was another database. A run now says where it
+ * was; one saved before that is judged by the tables it attacked.
+ */
+
+// Attacks named for a table, as opposed to a function or a bucket.
+const ON_A_TABLE = /^(exposed|crossed|writable|recursive|orphaned|duplicated|role|teamread):/;
+
+/** The tables a run looked at: as it said, or else as its attacks name them. */
+function tablesOf(run, said) {
+  if (said) return run.where.tables;
+  return Array.from(new Set(((run && run.attempted) || []).filter((key) => ON_A_TABLE.test(String(key)))
+    .map((key) => String(key).split(':')[1])));
+}
+
+/** A database, said the way a person would recognise it. */
+function placeOf(where) {
+  if (!where) return null;
+  return '"' + where.database + '"' + (where.host ? ' on ' + where.host + (where.port ? ':' + where.port : '') : '') +
+    (where.schema && where.schema !== 'public' ? ', schema "' + where.schema + '"' : '');
+}
+
+function elsewhereOf(before, after) {
+  const was = before && before.where;
+  const now = after && after.where;
+  const said = Boolean(was && now && Array.isArray(was.tables) && Array.isArray(now.tables));
+  const a = new Set(tablesOf(before, said));
+  const b = new Set(tablesOf(after, said));
+  const onlyBefore = Array.from(a).filter((t) => !b.has(t)).sort();
+  const onlyNow = Array.from(b).filter((t) => !a.has(t)).sort();
+  const union = new Set(Array.from(a).concat(Array.from(b))).size;
+  const shared = union - onlyBefore.length - onlyNow.length;
+  const otherDatabase = Boolean(was && now) && (was.database !== now.database ||
+    (was.host || null) !== (now.host || null) || (was.port || null) !== (now.port || null) || was.schema !== now.schema);
+  // Fewer than half the tables in common: not the same app any more. Only
+  // said when both runs name tables: a run that names none says nothing.
+  const otherShape = a.size > 0 && b.size > 0 && shared * 2 < union;
+  if (!otherDatabase && !otherShape) return null;
+  return { otherDatabase: otherDatabase, otherShape: otherShape, was: placeOf(was), now: placeOf(now),
+    onlyBefore: onlyBefore, onlyNow: onlyNow };
+}
+
 function compare(before, after) {
   const was = proofsOf(before && before.findings);
   const now = proofsOf(after && after.findings);
@@ -120,9 +167,13 @@ function compare(before, after) {
 
   const wasByKey = new Set(was.map(keyOf));
   const newlyBroken = now.filter((item) => !wasByKey.has(keyOf(item)));
+  const elsewhere = elsewhereOf(before, after);
 
   return {
     stopped: null,
+    // Set when the earlier run was on another database, or on a very
+    // different set of tables: then this is a comparison, not a re-check.
+    elsewhere: elsewhere,
     fixed: fixed,
     stillOpen: stillOpen,
     unverifiable: unverifiable,
@@ -138,7 +189,9 @@ function compare(before, after) {
     // unverifiable, so "the other two are empty" already means "all of them
     // were fixed" - stating that a third time as a count only made each guard
     // able to cover for the others, which is how a broken guard stays hidden.
+    // And never from two different databases: nothing was fixed between them.
     allClear:
+      !elsewhere &&
       !stillOpen.length &&
       !unverifiable.length &&
       !newlyBroken.length &&
@@ -172,10 +225,59 @@ function whatOf(item) {
   if (item.kind === 'duplicated') return 'the same ' + (item.column || 'value') + ' twice';
   if (item.kind === 'orphaned') return 'rows left pointing at nothing';
   if (item.kind === 'privileged') return 'a function anyone can call';
+  if (item.kind === 'role') return 'changed by a "' + (item.who || 'viewer') + '"';
+  if (item.kind === 'teamread') return 'read by a "' + (item.who || 'viewer') + '"';
+  if (item.kind === 'bucket') return 'a public storage bucket';
   if (item.kind === 'recursive') return 'a rule that refers to itself';
   return item.kind;
 }
 
+/** Wraps one paragraph for the screen, indented the way these lines are. */
+function wrapped(text) {
+  const out = [];
+  let current = '';
+  for (const word of String(text).split(/\s+/)) {
+    if ((current + ' ' + word).trim().length > 70) {
+      out.push('  ' + current.trim());
+      current = word;
+    } else {
+      current = (current + ' ' + word).trim();
+    }
+  }
+  if (current) out.push('  ' + current.trim());
+  return out;
+}
+
+/** Up to eight names, and how many more. */
+function someOf(names) {
+  const shown = names.slice(0, 8).join(', ');
+  return names.length > 8 ? shown + ' and ' + (names.length - 8) + ' more' : shown;
+}
+
+/**
+ * Said first when the earlier run was somewhere else: which two databases,
+ * and how their tables differ - so nothing after it reads as a fix.
+ */
+function elsewhereLines(elsewhere) {
+  const lines = [];
+  const tables = (n) => n + (n === 1 ? ' table' : ' tables');
+  lines.push('  This is not a re-check of the same database.');
+  lines.push('');
+  const where = elsewhere.otherDatabase
+    ? 'The earlier run kept for this folder was on ' + elsewhere.was + ', and this one is on ' + elsewhere.now + '.'
+    : 'The earlier run kept for this folder looked at a very different set of tables.';
+  wrapped(where + ' So what follows compares two databases: nothing in it means a fix worked, ' +
+    'and nothing in it means a fix broke something.').forEach((l) => lines.push(l));
+  lines.push('');
+  const shape = [];
+  if (elsewhere.onlyBefore.length) shape.push(tables(elsewhere.onlyBefore.length) + ' only in the earlier one (' + someOf(elsewhere.onlyBefore) + ')');
+  if (elsewhere.onlyNow.length) shape.push(tables(elsewhere.onlyNow.length) + ' only in this one (' + someOf(elsewhere.onlyNow) + ')');
+  wrapped(shape.length ? 'How their tables differ: ' + shape.join('; ') + '.' : 'Both have the same tables.')
+    .forEach((l) => lines.push(l));
+  lines.push('');
+  return lines;
+}
+
 /** What the re-check says, in the order it matters. */
 function describe(result) {
   const lines = [''];
@@ -188,24 +290,34 @@ function describe(result) {
     return lines;
   }
 
+  const elsewhere = result.elsewhere;
+  if (elsewhere) elsewhereLines(elsewhere).forEach((l) => lines.push(l));
+
   if (result.fixed.length) {
-    lines.push('  ' + result.fixed.length + (result.fixed.length === 1 ? ' problem is' : ' problems are') + ' fixed:');
+    const n = result.fixed.length;
+    lines.push(elsewhere
+      ? '  ' + n + ' found in the earlier run and not here:'
+      : '  ' + n + (n === 1 ? ' problem is' : ' problems are') + ' fixed:');
     lines.push('');
     for (const item of result.fixed) {
       // A function is never called, only read - so its fix is said as what
       // was seen, not as an attack that was refused. Found on a fix test.
       const how = item.kind === 'privileged'
-        ? 'I looked again, and a visitor with no account can no longer call it.'
+        ? (elsewhere ? 'I looked here, and a visitor with no account cannot call it.'
+          : 'I looked again, and a visitor with no account can no longer call it.')
+        : item.kind === 'bucket'
+        ? (elsewhere ? 'I looked here, and the bucket is not public.' : 'I looked again, and the bucket is no longer public.')
         : item.kind === 'recursive'
-        ? 'I read it again, and its rules answered instead of stopping with an error.'
-        : 'I ran the same attack again and it was refused.';
+        ? (elsewhere ? 'I read it here, and its rules answered.'
+          : 'I read it again, and its rules answered instead of stopping with an error.')
+        : (elsewhere ? 'I ran the same attack here and it was refused.' : 'I ran the same attack again and it was refused.');
       lines.push('    ' + item.table + ' (' + whatOf(item) + ') - ' + how);
     }
     lines.push('');
   }
 
   if (result.stillOpen.length) {
-    lines.push('  ' + result.stillOpen.length + ' still open:');
+    lines.push('  ' + result.stillOpen.length + (elsewhere ? ' found in both:' : ' still open:'));
     lines.push('');
     for (const item of result.stillOpen) {
       lines.push('    ' + item.table + ' - ' + item.headline);
@@ -216,32 +328,44 @@ function describe(result) {
   // Deliberately not under "fixed", and deliberately not silent. This is the
   // one a person would otherwise read as good news.
   if (result.unverifiable.length) {
-    lines.push('  ' + result.unverifiable.length + ' I could NOT confirm:');
+    lines.push('  ' + result.unverifiable.length + (elsewhere ? ' I could NOT compare:' : ' I could NOT confirm:'));
     lines.push('');
     for (const item of result.unverifiable) {
       lines.push('    ' + item.table + ' (' + whatOf(item) + ') - ' + item.why);
     }
     lines.push('');
-    lines.push('  These are not fixed and not broken - they are unknown. The problem');
-    lines.push('  stopped showing up, but not because the attack was refused.');
+    if (elsewhere) {
+      lines.push('  These were found in the earlier run, and the same attack did not run');
+      lines.push('  here, so whether they are here too is unknown.');
+    } else {
+      lines.push('  These are not fixed and not broken - they are unknown. The problem');
+      lines.push('  stopped showing up, but not because the attack was refused.');
+    }
     lines.push('');
   }
 
   if (result.newlyBroken.length) {
-    lines.push('  ' + result.newlyBroken.length + ' NEW ' +
-      (result.newlyBroken.length === 1 ? 'problem' : 'problems') + ' that were not there before:');
+    const n = result.newlyBroken.length;
+    lines.push(elsewhere
+      ? '  ' + n + ' found here and not in the earlier run:'
+      : '  ' + n + ' NEW ' + (n === 1 ? 'problem' : 'problems') + ' that were not there before:');
     lines.push('');
     for (const item of result.newlyBroken) {
       lines.push('    ' + item.table + ' - ' + item.headline);
     }
     lines.push('');
-    lines.push('  A fix can open something else. This is why the re-check looks at the');
-    lines.push('  whole app again and not only at what it was asked about.');
+    if (elsewhere) {
+      lines.push('  These are differences between the two databases, not something a fix');
+      lines.push('  opened.');
+    } else {
+      lines.push('  A fix can open something else. This is why the re-check looks at the');
+      lines.push('  whole app again and not only at what it was asked about.');
+    }
     lines.push('');
   }
 
   if (!result.fixed.length && !result.stillOpen.length && !result.unverifiable.length && !result.newlyBroken.length) {
-    lines.push('  Nothing to re-check - there was nothing open.');
+    lines.push(elsewhere ? '  Neither run found anything open.' : '  Nothing to re-check - there was nothing open.');
     lines.push('');
   }
 
@@ -262,6 +386,7 @@ function describe(result) {
 
 module.exports = {
   keyOf: keyOf,
+  elsewhereOf: elsewhereOf,
   compare: compare,
   describe: describe,
   badgeLines: badgeLines,