kryptheon-night 0.1.39 → 0.1.40

package/finding.js

@@ -1,1612 +1,1715 @@
-// Turning what the attack saw into something a person can act on.
-//
-// The detection is the easy tenth. A builder who cannot read code does not buy
-// "crossed:customers:1" - they buy knowing their customer list is open, seeing
-// it happen, and having one thing to paste that closes it.
-//
-// The rule everything here follows: never say more than was actually seen. If
-// the attack read a table with an email column in it, say email. If it did not,
-// do not reach for "personal details" because it sounds more urgent. A report
-// that overstates once is a report nobody trusts again, and trust is the entire
-// product - the re-check at the end is worth exactly as much as the first
-// report was honest.
-
-/* --------------------------------------------------------------------------
-   What was in the table.
--------------------------------------------------------------------------- */
-
-// Things that identify a person. Matched on whole words so that `company_name`
-// counts and `renamed_at` does not.
-const IDENTITY = [
-  [/\b(email|e_mail|mail)\b/i, 'email addresses'],
-  [/\b(phone|mobile|contact_number|telephone)\b/i, 'phone numbers'],
-  // `\b` treats "_" as part of a word, so display_name never matched `name` -
-  // found on a blind test, where a public profiles table was reported as
-  // holding nothing in particular. The compound names are listed instead.
-  [/\b(full_name|first_name|last_name|given_name|surname|name|display_name|username|user_name|nickname|screen_name)\b/i, 'names'],
-  [/\b(address|street|city|postcode|zip|pincode)\b/i, 'addresses'],
-  [/\b(dob|date_of_birth|birth_date|birthday)\b/i, 'dates of birth'],
-];
-
-// Things that are worse than identifying - they let somebody act as the person,
-// or take money.
-const SECRETS = [
-  // `\b` counts "_" as a letter, so these missed every compound name - found
-  // on a blind test: integration_token, access_token and signing_secret, all
-  // readable by anyone, and the report named none of them. A name that ENDS
-  // in the secret word is the secret; token_expires_at is only about one.
-  // Singular only: `tokens` and `input_tokens` count what an AI call used -
-  // found on the next blind test, where api_usage.tokens (an integer) was
-  // named as a secret.
-  [/\b(password|passwd|pass_hash|password_hash)\b|(^|_)(password|passwd|pwd|password_hash)$/i, 'passwords'],
-  [/\b(token|api_key|apikey|secret|private_key|access_key)\b|(^|_)(token|secret|(api|private|access|secret|signing|service|encryption)_?key)$/i, 'access tokens and secrets'],
-  [/\b(card|card_number|cvv|iban|account_number|upi)\b/i, 'payment details'],
-  // A code that grants something: whoever reads a moderator_code can become a
-  // moderator. Found on a blind test, added straight in production and readable
-  // by anyone - reported only as "2 rows".
-  [/^(?:\w+_)?(moderator|invite|invitation|access|reset|verification|recovery|admin|join|auth|login|magic|security|otp)_code$|^(otp|pin)$/i, 'secret codes'],
-];
-
-// Who holds power in the app. Not a secret in itself, but a list of exactly
-// which accounts are worth attacking.
-const PRIVILEGE = [/^(is_admin|is_superuser|is_super_admin|is_staff|is_moderator|is_owner|role|roles|permissions)$/i, 'who is an admin'];
-
-const MONEY = [/\b(amount|total|price|balance|salary|revenue|invoice)\b/i, 'amounts of money'];
-
-// Each kind named with the columns that showed it: "secret codes
-// (moderator_code)" can be found in the table; "secret codes" has to be
-// looked for.
-function matched(columns, table) {
-  const names = (columns || []).map(String);
-  const found = [];
-  for (const [pattern, label] of table) {
-    const hits = names.filter((column) => pattern.test(column));
-    if (hits.length) found.push(label + ' (' + hits.join(', ') + ')');
-  }
-  return found;
-}
-
-/** What a table holds, in the words a person would use. */
-function readContents(columns) {
-  const identity = matched(columns, IDENTITY);
-  const secrets = matched(columns, SECRETS);
-  const money = matched(columns, [MONEY]);
-  const privilege = matched(columns, [PRIVILEGE]);
-  return { identity: identity, secrets: secrets, money: money, privilege: privilege };
-}
-
-/** Everything worth naming, worst first. */
-function heldIn(contents) {
-  return contents.secrets.concat(contents.identity, contents.privilege || [], contents.money);
-}
-
-/** A list, written the way a person writes one. */
-function listOf(items) {
-  const list = items.filter(Boolean);
-  if (!list.length) return '';
-  if (list.length === 1) return list[0];
-  return list.slice(0, -1).join(', ') + ' and ' + list[list.length - 1];
-}
-
-/** One of a table's things: workspaces -> workspace, companies -> company. */
-/** A role, quoted, with its article: a "viewer", an "analyst". */
-function aRole(role) {
-  return (/^[aeiou]/i.test(String(role)) ? 'an "' : 'a "') + role + '"';
-}
-
-/** The first letter made a capital, for the start of a sentence. */
-function capital(text) {
-  return text.charAt(0).toUpperCase() + text.slice(1);
-}
-
-/** The same, with its article: a workspace, an organization. */
-function aOne(table) {
-  const one = oneOf(table);
-  return (/^[aeiou]/i.test(one) ? 'an ' : 'a ') + one;
-}
-
-function oneOf(table) {
-  return String(table || 'team').replace(/ies$/, 'y').replace(/s$/, '');
-}
-
-/* --------------------------------------------------------------------------
-   How bad it is.
--------------------------------------------------------------------------- */
-
-/**
- * Severity, decided by what could be read rather than by how it was read.
- *
- * Only two levels on purpose. A scale of five invites the reader to skim past
- * the bottom three, and everything the night shift reports is something that
- * should be fixed - there is no such thing as a low finding here.
- */
-function severityOf(finding, contents) {
-  if (finding.kind === 'recursive') {
-    // Nothing leaks and nothing is written: the request fails. Serious,
-    // because the app is broken for whoever it fails for, but not a break-in.
-    return 'HIGH';
-  }
-  // A member who can make themselves the owner: never the design, and the
-  // owner's reach is everything - the one role finding that is confirmed.
-  if (finding.kind === 'role' && finding.promote) return 'CRITICAL';
-  if (finding.kind === 'role' || finding.kind === 'teamread' || finding.kind === 'bucket') {
-    // Something to check, never a confirmed break: whether a viewer may edit,
-    // or a bucket may be public, is the owner's decision. So never CRITICAL.
-    return 'HIGH';
-  }
-  if (finding.kind === 'conflict' || finding.kind === 'searchpath' || finding.kind === 'nullcheck' || finding.kind === 'noinsert') {
-    // Read from how a function or a column is declared. A refused upsert
-    // breaks the app for whoever calls it; an open search_path and an empty
-    // value are for the owner to weigh. None of them hands a row to anybody.
-    return 'HIGH';
-  }
-  if (finding.kind === 'privileged') {
-    // Not proven, so never CRITICAL: this is a reach that exists, not a break
-    // that was demonstrated. A function anon can call that also writes is worth
-    // more attention than one that only reads, but both stay HIGH and both
-    // carry "verification required" - the person has to say whether the anon
-    // call was intended.
-    return 'HIGH';
-  }
-  if (finding.kind === 'orphaned') {
-    // Nothing is exposed and nothing is destroyed, so this is not the same
-    // order of thing as a table anyone can empty. It stays serious because
-    // the data it strands is data somebody asked to have deleted.
-    return 'HIGH';
-  }
-  if (finding.kind === 'writable') {
-    // Deleting and rewriting are unrecoverable in a way that reading is not:
-    // a leak is bad, but a customer table somebody emptied is gone. Being able
-    // only to add rows is serious and not the same thing.
-    const canDestroy = (finding.can || []).some((what) => what === 'delete' || what === 'change');
-    return canDestroy ? 'CRITICAL' : 'HIGH';
-  }
-  if (finding.kind === 'duplicated') {
-    // Judged by what the duplicate lets somebody do, not by what else sits in
-    // the table. A second row holding the same session token is critical even
-    // if the table has nothing personal in it at all.
-    if (finding.expectation === 'credential') return 'CRITICAL';
-    // Critical only while this column could be the login itself. When the
-    // database has Supabase's auth.users, sign-in goes through that table,
-    // which keeps every email unique - so a duplicate here is a copy that
-    // disagrees with itself, not two accounts sharing one login. Found on a
-    // real app: the report said "two accounts can answer to the same login"
-    // about a profiles table the login never read.
-    if (finding.expectation === 'identity') return finding.loginElsewhere ? 'HIGH' : 'CRITICAL';
-    return 'HIGH';
-  }
-  if (contents.secrets.length) return 'CRITICAL';
-  if (contents.identity.length) return 'CRITICAL';
-  return 'HIGH';
-}
-
-/* --------------------------------------------------------------------------
-   Saying it.
--------------------------------------------------------------------------- */
-
-/**
- * Why the door was open - and these two are genuinely different problems.
- *
- * Row level security switched off is an oversight. Switched on with a policy
- * that lets everybody through is worse, because the dashboard shows the table
- * as protected and the person has already been told they are safe. Saying which
- * one it is saves them looking in the wrong place.
- */
-function causeOf(finding) {
-  if (finding.kind === 'recursive') {
-    return {
-      short: 'a rule on it looks the same table up again',
-      long:
-        'A row level security rule on this table checks something by reading ' +
-        'this same table - usually "is this person a member?" asked of the ' +
-        'members table itself. Reading the table means applying the rule, and ' +
-        'applying the rule means reading the table, so Postgres stops the ' +
-        'request with an error instead of going round forever. Any other ' +
-        'table whose rule asks this one fails the same way.',
-    };
-  }
-  if (finding.kind === 'orphaned') {
-    return {
-      short: 'nothing in the database ties the two tables together',
-      long:
-        'There is no foreign key between these two tables, so the database has '+
-        'no idea they are related. It will not refuse a row that points at '+
-        'nothing, it will not stop somebody being deleted while their rows are '+
-        'still here, and it will never find these rows again afterwards.',
-    };
-  }
-  if (finding.kind === 'writable') {
-    if (finding.rlsEnabled) {
-      // Which rule let it through, from what is actually on the table rather
-      // than from an assumption.
-      //
-      // This branch used to say, of every writable table with row level
-      // security on, that its rule "covers every command rather than only
-      // reading". Measured against a table whose only policy was written FOR
-      // INSERT, that sentence was false twice over: the rule covered one
-      // command, and there was no rule letting anybody read at all. The
-      // finding was proved; the reason was invented. A report that overstates
-      // once is believed never again, so the reason is now read, not guessed.
-      const rules = (finding.rules || []).map((rule) => String(rule).toUpperCase());
-      const WRITTEN_FOR = { add: 'INSERT', change: 'UPDATE', 'delete': 'DELETE' };
-      const IN_WORDS = { INSERT: 'adding rows', UPDATE: 'changing rows', DELETE: 'deleting rows' };
-      const named = [];
-      for (const move of finding.can || []) {
-        const command = WRITTEN_FOR[move];
-        if (command && rules.includes(command) && !named.includes(command)) named.push(command);
-      }
-
-      if (rules.includes('ALL')) {
-        return {
-          short: 'the rule on it covers every command, not only reading',
-          long:
-            'The table has row level security switched on, but the rule attached ' +
-            'to it is written FOR ALL - so the same rule that decides who may ' +
-            'see a row also decides who may add, change and delete one, and it ' +
-            'is letting this through.',
-        };
-      }
-
-      if (named.length) {
-        return {
-          short: 'the rule you wrote for ' + listOf(named.map((c) => IN_WORDS[c])) +
-            ' lets everybody through',
-          long:
-            'The table has row level security switched on, and there is a rule on ' +
-            'it written for ' + listOf(named.map((c) => IN_WORDS[c])) + '. That ' +
-            'rule is the one letting this through: it does not check who is ' +
-            'asking, so it accepts the request from a stranger exactly as it ' +
-            'would from the person the row belongs to.',
-        };
-      }
-
-      // Row level security on, and no permissive rule that names this write.
-      // It should not have been possible, and saying which rule did it would
-      // be inventing one. What is certain is what was done, and that is all
-      // this says.
-      return {
-        short: 'row level security is on, and something let this through anyway',
-        long:
-          'The table has row level security switched on, and none of the rules on ' +
-          'it are written for this kind of write - so this should have been ' +
-          'refused and was not. Check whether the role your app connects as owns ' +
-          'the table or has BYPASSRLS, because either of those goes round every ' +
-          'rule you have written.',
-      };
-    }
-    return {
-      short: 'row level security was never switched on',
-      long:
-        'Row level security has never been switched on for this table. Supabase ' +
-        'grants insert, update and delete on the public schema by default, and ' +
-        'row level security is what takes them back - so until it is on, those ' +
-        'permissions are simply in force.',
-    };
-  }
-  if (finding.isView) {
-    // The one people are caught by, because everything looks right. The table
-    // is protected, the policy is correct, the dashboard is green - and the
-    // view hands the rows out anyway.
-    return {
-      short: 'a view reads with its creator\'s rights, not the visitor\'s',
-      long:
-        'This is a view, and a view runs as whoever created it unless it is ' +
-        'told otherwise. So any row level security on the tables underneath is ' +
-        'checked against the creator, not against the person asking - and the ' +
-        'rules you wrote on those tables do not apply here at all.',
-    };
-  }
-  if (finding.kind === 'duplicated') {
-    return {
-      short: 'nothing in the database makes it unique',
-      long:
-        'There is no unique constraint and no unique index on this column, so ' +
-        'the database has no way to refuse the second one. Checking in your app ' +
-        'code before inserting does not close this: between the check and the ' +
-        'insert, the other request has already been accepted.',
-    };
-  }
-  if (finding.rlsEnabled) {
-    return {
-      short: 'the rule that guards it lets everybody through',
-      long:
-        'The table has row level security switched on, so it looks protected, ' +
-        'but the rule attached to it allows every request. That is why nothing ' +
-        'in your dashboard flags it.',
-    };
-  }
-  return {
-    short: 'it has no protection switched on at all',
-    long:
-      'Row level security has never been switched on for this table, so every ' +
-      'rule you might have written elsewhere does not apply to it.',
-  };
-}
-
-/** What a caller could do, written the way a person would say it. */
-const WRITE_WORDS = { add: 'add rows to', change: 'change rows in', delete: 'delete rows from' };
-
-/**
- * The error a looping rule produces, as Postgres words it. A rule that reads
- * its own table directly is caught as recursion and named; one that reaches
- * it through a helper function runs out of stack, and Postgres names nothing.
- */
-function loopError(finding) {
-  return finding.deep
-    ? '"stack depth limit exceeded"'
-    : '"infinite recursion detected in policy for relation ' + finding.table + '"';
-}
-
-/** Who a looping rule fails for, said the way the headline and body need it. */
-function loopVictims(finding) {
-  const callers = finding.callers || [];
-  if (callers.includes('anyone') && callers.includes('signed-in')) return 'everyone, signed in or not,';
-  if (callers.includes('anyone')) return 'visitors who are not logged in';
-  return 'signed-in users';
-}
-
-function headlineFor(finding) {
-  if (finding.kind === 'recursive') {
-    return 'A rule on your ' + finding.table + ' table refers to itself, so ' + loopVictims(finding) +
-      ' get an error instead of data.';
-  }
-  if (finding.kind === 'orphaned') {
-    return 'Your ' + finding.table + ' table can point at a ' +
-      finding.parent.replace(/s$/, '') + ' that does not exist.';
-  }
-  if (finding.kind === 'writable') {
-    // Worst first, because the headline is often all that gets read.
-    const order = ['delete', 'change', 'add'];
-    const does = order.filter((what) => (finding.can || []).includes(what)).map((what) => WRITE_WORDS[what]);
-    return (finding.who === 'anyone' ? 'Anyone' : 'Any signed-in customer') + ' can ' +
-      listOf(does) + ' your ' + finding.table + ' table.';
-  }
-  if (finding.kind === 'duplicated') {
-    return 'Your ' + finding.table + ' table lets the same ' + finding.column + ' exist twice.';
-  }
-  if (finding.kind === 'privileged') {
-    return 'Anyone on the internet can call your ' + finding.fn + ' function, and it runs with full rights.';
-  }
-  if (finding.kind === 'searchpath') {
-    return 'Your ' + finding.fn + ' function runs with full rights but does not pin its search_path.';
-  }
-  if (finding.kind === 'conflict') {
-    return 'Your ' + finding.fn + ' function fails every time it saves: Postgres refuses its ON CONFLICT.';
-  }
-  if (finding.kind === 'nullcheck') {
-    return 'Your ' + finding.table + ' table accepts rows with no ' + finding.column + ' at all.';
-  }
-  if (finding.kind === 'noinsert') {
-    return 'Nobody can add a row to your ' + finding.table + ' table: its rule for adding rows checks nothing, and Postgres reads that as no.';
-  }
-  if (finding.kind === 'role' && finding.takeover) {
-    return capital(aRole(finding.who)) + ' in ' + aOne(finding.parent) + ' can take another member\'s place in your ' +
-      finding.table + ' table - and with it their role.';
-  }
-  if (finding.kind === 'role' && finding.movein) {
-    return 'Anyone signed in can make themselves ' + aRole(finding.toRole) + ' of any ' + oneOf(finding.parent) +
-      ' by moving their own row in your ' + finding.table + ' table into it.';
-  }
-  if (finding.kind === 'role' && finding.promote) {
-    return capital(aRole(finding.who)) + ' in ' + aOne(finding.parent) + ' can make themselves ' + aRole(finding.toRole) +
-      ' by changing their own row in your ' + finding.table + ' table.';
-  }
-  if (finding.kind === 'role') {
-    const order = ['delete', 'change', 'add'];
-    const does = order.filter((what) => (finding.can || []).includes(what)).map((what) => WRITE_WORDS[what]);
-    return capital(aRole(finding.who)) + ' in ' + aOne(finding.parent) + ' can ' + listOf(does) + ' your ' +
-      finding.table + ' table.';
-  }
-  if (finding.kind === 'teamread') {
-    return capital(aRole(finding.who)) + ' in ' + aOne(finding.parent) + ' can read your ' + finding.table +
-      ' table, which holds ' + listOf(finding.secrets || []) + '.';
-  }
-  if (finding.kind === 'bucket' && finding.noRule && (finding.writers || []).length) {
-    return 'Your ' + finding.table + ' storage bucket is public, though only signed-in members may put files in it.';
-  }
-  if (finding.kind === 'bucket' && finding.noRule) {
-    return 'Your ' + finding.table + ' storage bucket is public, and its name says its files are not for everyone.';
-  }
-  if (finding.kind === 'bucket') {
-    return 'Your ' + finding.table + ' storage bucket is public, but a rule says only some people may read it.';
-  }
-  if (finding.kind === 'exposed') {
-    return 'Your ' + finding.table + ' ' + (finding.isView ? 'view' : 'table') + ' can be read by anyone.';
-  }
-  // The table name goes in front of the sentence rather than inside it. Put
-  // inside, a table called `customers` produced "One customer can read another
-  // customer's customers", which is the kind of line that loses a reader.
-  if (finding.asRole) {
-    return capital(aRole(finding.asRole)) + ' of any ' + oneOf(finding.parent) + ' can read every other ' + oneOf(finding.parent) +
-      '\'s rows in your ' + finding.table + ' table.';
-  }
-  if (finding.tenant) return 'Your ' + finding.table + ' table lets a signed-in user read another organization\'s rows.';
-  return 'Your ' + finding.table + ' table lets one customer read another one\'s rows.';
-}
-
-/** What a duplicate of this particular column actually costs the person. */
-const COST_OF_A_DUPLICATE = {
-  credential: 'A credential that matches more than one row means one secret opens more than one account.',
-  identity: 'Two accounts can answer to the same login, and a password reset has to guess which one to send.',
-  code: 'A one-time code that can exist twice can be redeemed twice.',
-};
-
-// Said instead of the login sentence when sign-in happens in auth.users.
-const COST_OF_A_COPIED_IDENTITY =
-  'Signing in is not affected: your app signs people in through auth.users, ' +
-  'which keeps each email unique. But anything that looks a person up by this ' +
-  'column can get two rows back and pick the wrong one.';
-
-function costOf(finding) {
-  if (finding.expectation === 'identity' && finding.loginElsewhere) return COST_OF_A_COPIED_IDENTITY;
-  return COST_OF_A_DUPLICATE[finding.expectation] || '';
-}
-
-function bodyFor(finding, contents) {
-  const holds = listOf(heldIn(contents));
-  const rowWord = finding.readable === 1 ? 'row' : 'rows';
-
-  if (finding.kind === 'recursive') {
-    // Said as what happened to the requests, and then what it cost this
-    // report: the tables behind the error could not be tested for leaks.
-    const reads = finding.reads || [];
-    const callers = finding.callers || [];
-    const as = [];
-    if (callers.includes('anyone')) as.push('a visitor who is not logged in');
-    if (callers.includes('signed-in')) as.push('a signed-in user');
-    const one = reads.length === 1;
-    return (
-      'Using ' + listOf(reads) + ' on a copy of your app as ' + as.join(' and as ') +
-      ', every request was refused with ' + loopError(finding) +
-      (finding.deep ? ' - a rule on ' + finding.table + ' calls a helper that reads ' + finding.table + ' again, which runs the rule again' : '') +
-      '. Every page in your app that uses ' + (one ? 'that table' : 'those tables') +
-      ' fails the same way for ' + loopVictims(finding).replace(/,$/, '') + '. It also means I could ' +
-      'not test ' + (one ? 'it' : 'them') + ' for leaks - those attacks are listed at the end.'
-    );
-  }
-
-  if (finding.kind === 'orphaned') {
-    // Said as the thing a person will actually meet: a customer asks to be
-    // deleted, and their rows are still here afterwards.
-    return (
-      'I added a row to ' + finding.table + ' naming a ' +
-      finding.parent.replace(/s$/, '') + " that is not in your " + finding.parent +
-      ' table, and it was accepted. So when one of them is deleted, the rows here ' +
-      'stay behind pointing at nobody - and a signup or checkout that stops halfway ' +
-      'leaves the same thing. The row I added was undone straight away.'
-    );
-  }
-
-  if (finding.kind === 'writable') {
-    const holds = listOf(heldIn(contents));
-    const who = finding.who === 'anyone'
-      ? 'Without logging in and without an account, I '
-      : 'Signed in as one of your customers, I ';
-    const did = [];
-    if ((finding.can || []).includes('add')) did.push('added a row');
-    if ((finding.can || []).includes('change')) {
-      did.push('changed ' + (finding.changed.change || 1) + " of another customer's rows");
-    }
-    if ((finding.can || []).includes('delete')) {
-      did.push('deleted ' + (finding.changed.delete || 1) + " of another customer's rows");
-    }
-    // Said immediately, because "I deleted your rows" is a sentence that stops
-    // somebody reading, and they need the next line more than the first.
-    return who + listOf(did) + ' on a copy of your app' +
-      (holds ? ', in a table holding ' + holds : '') +
-      '. Every one of those was undone straight away - nothing on the copy was ' +
-      'kept, and your live app was never touched.';
-  }
-
-  if (finding.kind === 'role' && finding.takeover) {
-    // Not a matter of taste like a viewer who may edit: taking somebody
-    // else's membership is never what a role is for.
-    const place = oneOf(finding.parent);
-    return (
-      'I put one of my fake people into the other one\'s ' + place + ' as ' + aRole(finding.who) +
-      ' in ' + finding.via + '.' + finding.roleColumn + ' and, signed in as them, changed ' +
-      finding.via + '.' + finding.personColumn + ' on the other person\'s own membership row to their own id - so ' +
-      'they held that member\'s place and role, on a copy of your app. Before joining, they could not. It was ' +
-      'undone straight away. A member taking over another member\'s row is never something a role should be able ' +
-      'to do, even where members may edit some of a membership.'
-    );
-  }
-
-  if (finding.kind === 'role' && finding.movein) {
-    // Never the design: nobody was invited, and the team they moved into is
-    // somebody else's.
-    const place = oneOf(finding.parent);
-    return (
-      'Signed in as one of my fake people - not a member of the other one\'s ' + place + ', never invited - I ' +
-      'changed their own row in ' + finding.via + ': ' + listOf((finding.moved || []).map((c) => finding.via + '.' + c)) +
-      ' to the other ' + place + ', and ' + finding.via + '.' + finding.roleColumn + ' to "' + finding.toRole +
-      '" - on a copy of your app. It went through, and was undone straight away. Anybody who can sign up and has a ' +
-      place + ' of their own can do this to every ' + place + ' whose id they learn, and from then on has every right ' +
-      aRole(finding.toRole) + ' has there.'
-    );
-  }
-  if (finding.kind === 'role' && finding.promote) {
-    // Never the design: a member who can raise their own role has every
-    // right the top role has, in every table that trusts the role.
-    const place = oneOf(finding.parent);
-    return (
-      'I put one of my fake people into the other one\'s ' + place + ' as ' + aRole(finding.who) +
-      ' in ' + finding.via + '.' + finding.roleColumn + ' and, signed in as them, changed ' + finding.via + '.' +
-      finding.roleColumn + ' on their own membership row to "' + finding.toRole + '" - on a copy of your app. It was ' +
-      'undone straight away. From then on they would have every right ' + aRole(finding.toRole) + ' has, in every ' +
-      'table and function that trusts that role.'
-    );
-  }
-
-  if (finding.kind === 'role') {
-    // Said as what was done, and then whose decision it is: a viewer who may
-    // edit is a hole in one app and the design of another.
-    const did = [];
-    const rows = (n) => n + (n === 1 ? ' row' : ' rows');
-    if ((finding.can || []).includes('add')) did.push('added ' + rows((finding.changed || {}).add || 1));
-    if ((finding.can || []).includes('change')) did.push('changed ' + rows((finding.changed || {}).change || 1));
-    if ((finding.can || []).includes('delete')) did.push('deleted ' + rows((finding.changed || {}).delete || 1));
-    const place = oneOf(finding.parent);
-    // The roles below it that were tried first and could not, when there are
-    // any: a role in the middle is named because the ones under it held.
-    const below = (finding.below || []).map((r) => '"' + r + '"');
-    return (
-      'I put one of my fake people into the other one\'s ' + place + ' as ' + aRole(finding.who) +
-      ' - ' + (below.length ? 'a role' : 'the lowest role') + ' in ' + finding.via + '.' + finding.roleColumn +
-      ' - and, signed in as them, I ' + listOf(did) + ' in ' + finding.table + ' for that ' + place +
-      ', on a copy of your app. Before joining, they could not.' +
-      (below.length ? ' As ' + listOf(below).replace(/ and /, ' or ') + ' they could not either, and no rule on this ' +
-        'table lists ' + aRole(finding.who).replace(/^an? /, '') + ' among the roles allowed to make that change.' : '') +
-      ' Every one of those was undone straight away. Whether ' + aRole(finding.who) + ' may do this is your ' +
-      'decision: if it is meant to, nothing needs fixing; if not, the rules on this table let them do more.'
-    );
-  }
-
-  if (finding.kind === 'teamread') {
-    // Said as what was read and by whom, and which roles below it could not:
-    // a dispatcher seeing a key may be the design, a viewer rarely is.
-    const place = oneOf(finding.parent);
-    const n = finding.readable || 1;
-    const below = (finding.below || []).map((r) => '"' + r + '"');
-    return (
-      'I put one of my fake people into the other one\'s ' + place + ' as ' + aRole(finding.who) + ' and, signed ' +
-      'in as them, read ' + n + (n === 1 ? ' row' : ' rows') + ' of ' + finding.table + ' for that ' + place +
-      ', on a copy of your app - including ' + listOf(finding.secrets || []) + '. Before joining, they could not.' +
-      (below.length ? ' As ' + listOf(below).replace(/ and /, ' or ') + ' they could not read it either.' : '') +
-      ' Nothing was changed. Whether ' + aRole(finding.who) + ' should see these is your decision: if not, a read ' +
-      'rule on this table lets them.'
-    );
-  }
-
-  if (finding.kind === 'bucket' && finding.noRule) {
-    return (
-      'In Supabase Storage the bucket "' + finding.bucket + '" is set to public, so anyone with a ' +
-      'file\'s link can download it without logging in - the rules on storage.objects are not asked. ' +
-      ((finding.writers || []).length
-        ? 'No rule says who may read it, but ' + listOf((finding.writers || []).map((r) => '"' + r + '"')) +
-          ' let only signed-in members put files in or take them out - so the app treats these files as its ' +
-          'members\' own, while anyone holding a link can download them. '
-        : 'No rule says who may read it, but its name says what it holds, and that does not sound like ' +
-          'something for everyone. ') +
-      'I only read the bucket\'s setting and its rules; I did not open or list ' +
-      'any file. Whether it should be public is yours to say.'
-    );
-  }
-  if (finding.kind === 'bucket') {
-    // Said as what was read, never as a file taken: no file was opened.
-    return (
-      'In Supabase Storage the bucket "' + finding.bucket + '" is set to public, so anyone with a ' +
-      'file\'s link can download it without logging in - the rules on storage.objects are not asked. ' +
-      'You also wrote ' + ((finding.rules || []).length === 1 ? 'a rule' : 'rules') + ' saying who may read it (' +
-      listOf(finding.rules || []) + '), so it was probably meant to be private. I only read the ' +
-      'bucket\'s setting and its rules; I did not open or list any file. Whether it should be public ' +
-      'is yours to say.'
-    );
-  }
-
-  if (finding.kind === 'searchpath') {
-    return (
-      'This function is SECURITY DEFINER, so it runs as whoever created it and the row level ' +
-      'security on the tables it touches is skipped for the caller - and ' +
-      (finding.anon ? 'anyone, even without an account,' : 'every signed-in user') + ' can call it. ' +
-      'It does not set its search_path, so every table or function inside it written without a ' +
-      'schema (scans rather than public.scans) is looked up wherever the caller\'s path points ' +
-      'first. Somebody able to put a table or function earlier on that path would make it use ' +
-      'theirs, with the owner\'s rights. I did not call it; this is read from how it is declared.'
-    );
-  }
-  if (finding.kind === 'conflict') {
-    return (
-      finding.fn + ' inserts into ' + finding.target + ' with ON CONFLICT (' + finding.on + '). ' +
-      'Postgres needs a unique index or constraint on exactly those columns to know what a ' +
-      'conflict is, and ' + finding.target + ' has none it can use, so it refuses the statement - ' +
-      'the function errors on every call instead of saving. ' +
-      (finding.partialWhere
-        ? 'There is a unique index on those columns, but it is partial (WHERE ' + finding.partialWhere +
-          '), and a partial index is only used when the ON CONFLICT repeats its WHERE. '
-        : '') +
-      'I did not call the function: I asked Postgres to plan that one statement on the copy, and ' +
-      'it answered "there is no unique or exclusion constraint matching the ON CONFLICT specification".'
-    );
-  }
-  if (finding.kind === 'nullcheck') {
-    return (
-      finding.column + ' has a CHECK that allows only ' +
-      listOf((finding.allowed || []).map((v) => '\'' + v + '\'')) + ' - but a CHECK only refuses a ' +
-      'value it can show is wrong, and an empty value (NULL) is never shown wrong, so it passes. ' +
-      'The column is not NOT NULL and has no default, so a row saved without a ' + finding.column +
-      ' is kept with none, and anything that shows or sorts by it has to cope. I did not insert ' +
-      'anything; this is read from how the column is declared.'
-    );
-  }
-  if (finding.kind === 'noinsert') {
-    return (
-      'Row level security is on for ' + finding.table + ', and the only ' + ((finding.rules || []).length === 1 ? 'rule' : 'rules') +
-      ' for adding rows (' + listOf((finding.rules || []).map((r) => '"' + r + '"')) + ') ' +
-      ((finding.rules || []).length === 1 ? 'has' : 'have') + ' neither USING nor WITH CHECK. A rule with no ' +
-      'expression is not "allow everything": Postgres treats it as false, so every INSERT - from the app, ' +
-      'and from any function that runs as the user - is refused with "new row violates row-level security ' +
-      'policy". If your app adds ' + finding.table + ' rows, that feature is broken for everyone. This is read ' +
-      'from how the rule is written; I did not insert anything.'
-    );
-  }
-  if (finding.kind === 'privileged') {
-    // Said as what is true, not as what was done - nothing was executed. The
-    // reach is real; whether it is a mistake is the person's to say, so the
-    // wording asks rather than accuses.
-    return (
-      'This function is SECURITY DEFINER, so it runs as whoever created it, not ' +
-      'as the visitor calling it - which means the row level security on the tables ' +
-      'it touches is checked against the owner and skipped for the caller. It is ' +
-      'granted to anon, the role a visitor with no account uses, so anyone on the ' +
-      'internet can call it' +
-      (finding.writes ? ' - and it writes to your data, so a caller can change rows the rules would otherwise protect.'
-                       : ', reaching whatever it reads past the rules on those tables.') +
-      ' I did not call it: whether an open function like this is intended is ' +
-      'something only you can confirm.' +
-      (finding.nullSlips
-        ? ' Its first lines do check the caller\'s role - but with NOT IN or <>, and somebody with no role ' +
-          'there gets NULL back, and NULL NOT IN (...) is not true: the IF never raises, so a signed-in ' +
-          'stranger gets through as if they had passed.'
-        : '') +
-      (finding.hasFixedSearchPath ? ''
-        : ' It also does not pin its search_path, so a caller can point the names ' +
-          'inside it at their own objects.')
-    );
-  }
-  if (finding.kind === 'duplicated') {
-    // Said as what was done, not as what it implies. Two connections, one
-    // moment, both accepted, and here is the count afterwards.
-    return (
-      'I opened two connections to a copy of your app and inserted the same ' +
-      finding.column + ' from both at the same moment. Both were accepted, so there are ' +
-      'now ' + finding.copies + ' rows holding the identical value. ' + costOf(finding)
-    ).trim();
-  }
-
-  if (finding.kind === 'exposed') {
-    // Two different proofs, said as two different things. The copy-based scan
-    // signed in with the anon key and pulled the rows out; the outside check
-    // (outside.js) asked the live app for the count alone and never pulled a
-    // row, so it may not claim it did.
-    if (finding.countOnly) {
-      const many = finding.readable === 1 ? 'is 1 row' : 'are ' + finding.readable + ' rows';
-      return (
-        'Anyone on the internet, without logging in and without an account, can read ' +
-        'this table. I asked your live app as a stranger and it let me - there ' + many +
-        ' in it. I asked only for the count, so I never pulled a row out; a real ' +
-        'attacker would have taken them.'
-      );
-    }
-    return (
-      'Anyone on the internet, without logging in and without an account, can read ' +
-      // Read back the next morning, "just now" would be untrue: it was the
-      // nightly run, hours earlier.
-      'this table. ' + (finding.fromNight ? 'The nightly run did it on a copy and got back ' : 'I did it myself just now and got back ') +
-      finding.readable + ' ' + rowWord +
-      (holds ? ', including ' + holds : '') + '.'
-    );
-  }
-  if (finding.asRole) {
-    // Blind round 15: a role check in a read rule that was never tied to the
-    // row's own organization.
-    return (
-      'I made one of my fake people ' + aRole(finding.asRole) + ' of their own ' + oneOf(finding.parent) + ' (' + finding.via + '.' +
-      finding.roleColumn + ') and, signed in as them, asked for the other ' + oneOf(finding.parent) + '\'s rows in ' + finding.table +
-      ' and got ' + finding.readable + ' back' + (holds ? ', including ' + holds : '') + '. With an ordinary role they got none. ' +
-      'So anybody who is ' + aRole(finding.asRole) + ' anywhere - which in most apps means anybody who creates their own ' +
-      oneOf(finding.parent) + ' - can read every ' + oneOf(finding.parent) + '\'s rows here.'
-    );
-  }
-  if (finding.tenant) {
-    return (
-      'Signed in as someone in a different organization, I asked for another organization\'s rows and got ' +
-      finding.readable + ' of them back' + (holds ? ', including ' + holds : '') +
-      '. Anyone with an account can read every organization\'s rows.'
-    );
-  }
-  return (
-    'Signed in as one customer, I asked for another customer\'s rows and got ' +
-    finding.readable + ' of them back' + (holds ? ', including ' + holds : '') +
-    '. Every customer you have can do this to every other customer.'
-  );
-}
-
-/**
- * The thing they paste.
- *
- * Written to the tool they already use, which means it has to carry its own
- * context - the assistant on the other end has not seen any of this. It names
- * the table, says what is wrong in terms of the code rather than the symptom,
- * and asks for the same mistake to be swept up elsewhere, because it is almost
- * never in only one place.
- */
-/** Wraps one paragraph to a width that reads in a chat box and a terminal. */
-function wrapTo(text, width) {
-  const words = String(text).split(/\s+/);
-  const out = [];
-  let current = '';
-  for (const word of words) {
-    if ((current + ' ' + word).trim().length > width) {
-      out.push(current.trim());
-      current = word;
-    } else {
-      current = (current + ' ' + word).trim();
-    }
-  }
-  if (current) out.push(current.trim());
-  return out;
-}
-
-/**
- * Whether the app signs people in through Supabase: any foreign key to
- * auth.users, or any rule that asks auth.uid() or auth.jwt(). Decided for the
- * whole app, not table by table. Found on a blind test: appointments points
- * at profiles, which points at auth.users - no key of its own and no rule
- * asking auth.uid(), so it was told the app "signs people in its own way"
- * when it plainly used Supabase's. Read from the original schema, not the
- * copy - the copy points those keys at a stand-in. A table missing from the
- * map is unknown, which the prompts treat as tied.
- */
-function authTiesOf(plan) {
-  const tables = (plan && plan.tables) || [];
-  const keyed = tables.some((table) => (table.constraints || []).some((c) =>
-    c.kind === 'f' && /references\s+"?auth"?\s*\.\s*"?users"?\s*\(/i.test(String(c.definition || ''))));
-  const asked = ((plan && plan.policies) || []).some((policy) =>
-    /\bauth\s*\.\s*(uid|jwt)\s*\(/i.test(String(policy.qual || '') + ' ' + String(policy.with_check || '')));
-  return new Map(tables.map((table) => [table.name, keyed || asked]));
-}
-
-/**
- * The fix for a table no rule can tie to the signed-in user, or null when one
- * can. Two ways that happens. The app has its own login: found on a real app,
- * "compare the owner to the id of the signed-in user" cannot be done there -
- * auth.uid() is empty for everybody - and an assistant that writes it anyway
- * locks the app out of its own table. Or the table has no column saying whose
- * row it is - a waitlist, a contact form - so there is nothing to compare.
- */
-// A column that says which organization a row belongs to. Such a table is
-// not "nobody's" - its rows are a team's.
-const TENANT_COLUMN = /^(org_id|organization_id|workspace_id|team_id|tenant_id|company_id)$/i;
-
-function serverOnlyLines(finding) {
-  const table = finding.table;
-  let why;
-  // Found on a fix test: api_usage has org_id, and the prompt said it had no
-  // column saying whose row it is. The assistant applying it had to correct
-  // the prompt; a less careful one would have locked the table away from the
-  // members who use it.
-  // A row an organization owns names its organization even when the column is
-  // not called organization_id: the attack found which key it is.
-  const team = finding.authTied !== false &&
-    (finding.tenant ? finding.owner : (finding.columns || []).find((c) => TENANT_COLUMN.test(String(c))));
-  const maker = finding.owner || finding.ownedBy;
-  // A team's row that also says who made it - created_by beside workspace_id.
-  // Found on a benchmark: the prompt said to compare created_by to auth.uid()
-  // for reading, which hides every teammate's rows and breaks the shared
-  // view the table exists for. Who made a row decides who may write it
-  // under their name, not who may see it.
-  if (team && !finding.tenant && finding.owned !== false && maker) {
-    return [
-      'Rows in "' + table + '" belong to a team ("' + team + '"), and "' + maker + '" only records who ' +
-        'made each one. So reading should be decided by team membership: let a signed-in user read a ' +
-        'row when they are a member of that row\'s "' + team + '" - checked through your membership ' +
-        'table, or a helper function that asks it - and give logged-out visitors nothing. Do not ' +
-        'compare "' + maker + '" to auth.uid() for reading: that hides teammates\' rows from each other ' +
-        'and breaks the feature.',
-      '',
-      'Write separate rules for reading, inserting, updating and deleting. Inserting: WITH CHECK that ' +
-        'the user is a member of the row\'s "' + team + '" AND "' + maker + '" = auth.uid(), so nobody ' +
-        'writes a row under somebody else\'s name or into a team they are not in. Updating and ' +
-        'deleting: the membership check in USING (and WITH CHECK for updating), and decide whether any ' +
-        'member may do it or only the row\'s "' + maker + '" or an admin. If only your server writes ' +
-        'this table, add no write rules at all.',
-      '',
-    ];
-  }
-  const tenant = (finding.tenant || finding.owned === false) && team;
-  if (tenant) {
-    return [
-      'Rows in "' + table + '" belong to an organization ("' + tenant + '"), not to one person. So the ' +
-        'rule should let a signed-in user in only when they are a member of that row\'s organization - ' +
-        'checked through your membership table, or a helper function that asks it - and give logged-out ' +
-        'visitors nothing.',
-      '',
-      'Write separate rules for reading, inserting, updating and deleting, each with that membership ' +
-        'check (USING for reading, updating and deleting, WITH CHECK for inserting and updating), and ' +
-        'decide whether every member should be able to write or only admins. If only your server ' +
-        'writes this table, add no write rules at all.',
-      '',
-    ];
-  }
-  if (finding.authTied === false) {
-    why = 'Nothing in "' + table + '" points at auth.users and no rule on it uses auth.uid(), so your ' +
-      'app signs people in its own way. A rule comparing a column to the signed-in user cannot ' +
-      'work here - auth.uid() is empty for everyone - and adding one would lock your own app out.';
-  } else if (finding.owned === false) {
-    why = '"' + table + '" has no column that says whose row it is, so a rule tying rows to the ' +
-      'signed-in user has nothing to compare against.';
-  } else {
-    return null;
-  }
-  return [
-    why,
-    '',
-    'If only your server reads and writes this table: keep row level security on, drop the rules ' +
-      'that let everyone in, and add none for anon or authenticated. Have your server use the ' +
-      'service_role key, which skips these rules - and keep that key on the server only, never ' +
-      'in the browser or in the app\'s public code.',
-    '',
-    'If the browser needs to read or write part of it directly, tell me which part first, so we ' +
-      'write the narrowest rule for exactly that.',
-    '',
-  ];
-}
-
-/**
- * The opening of a rules fix. "Switch row level security on" is said only
- * when it is off: told it about a table where it was already on, the person
- * looks for a switch that is already flipped and misses the rule that is the
- * real problem.
- */
-function switchOn(finding) {
-  return finding.rlsEnabled
-    ? 'Row level security is already on for this table, so the rules on it are the problem: '
-    : 'Switch row level security on for this table, then ';
-}
-
-/**
- * One prompt for everything wrong with one table's rules - read and write,
- * strangers and customers - because it is one rule to replace, not four.
- */
-function groupPromptFor(members) {
-  const lead = members.find((m) => m.kind === 'writable') || members[0];
-  const cause = causeOf(lead);
-  const table = lead.table;
-  const owner = (members.find((m) => m.owner) || {}).owner;
-  const ownerWords = owner ? '"' + owner + '"' : 'the column that says who each row belongs to';
-  const read = members.find((m) => m.kind === 'exposed');
-  const writers = members.filter((m) => m.kind === 'writable');
-  const anyoneWrites = writers.find((w) => w.who === 'anyone');
-  const customersWrite = writers.find((w) => w.who !== 'anyone');
-  const what = [];
-  if (read) what.push('read');
-  if (writers.length) what.push('written');
-  const who = read || anyoneWrites ? 'anyone who is not logged in' : 'any signed-in user, including other users\' rows';
-  const did = [];
-  if (read) did.push('read ' + read.readable + ' ' + (read.readable === 1 ? 'row' : 'rows'));
-  const moves = [];
-  for (const w of writers) for (const m of w.can || []) if (!moves.includes(m)) moves.push(m);
-  for (const m of ['add', 'change', 'delete']) {
-    if (moves.includes(m)) did.push({ add: 'added a row', change: 'changed rows', delete: 'deleted rows' }[m]);
-  }
-  const lines = [
-    'My app has a security problem.',
-    '',
-    'The "' + table + '" table can be ' + what.join(' and ') + ' by ' + who +
-      ', because ' + cause.short + '. I proved it on a copy: I ' + listOf(did) + '.' +
-      (anyoneWrites && customersWrite ? ' Signed-in users can do the same.' : ''),
-    '',
-  ].concat(
-    serverOnlyLines(lead) || [
-        switchOn(lead) + 'remove the rule that lets everyone in, and write separate rules for reading, ' +
-          'inserting, updating and deleting. A rule written FOR ALL covers far more than reading.',
-        '',
-        'Each of them should compare ' + ownerWords + ' to the id of the signed-in user (auth.uid()): ' +
-          'USING for reading, updating and deleting, WITH CHECK for inserting and updating, so nobody ' +
-          'reads, changes or writes a row under somebody else\'s name. Give logged-out visitors no rule ' +
-          'at all unless they truly need one.',
-        '',
-      ],
-    ['Then check every other table for the same thing.'],
-  );
-  return lines
-    .map((paragraph) => (paragraph ? wrapTo(paragraph, 72) : ['']))
-    .reduce((all, part) => all.concat(part), [])
-    .join('\n');
-}
-
-function fixPromptFor(finding) {
-  const cause = causeOf(finding);
-  const owner = finding.owner ? '"' + finding.owner + '"' : 'the column that says who each row belongs to';
-
-  const lines = finding.kind === 'recursive'
-    ? [
-      'My app has a broken database rule.',
-      '',
-      'A row level security policy on the "' + finding.table + '" table reads "' + finding.table +
-        '" itself' + (finding.deep ? ', through a helper function it calls,' : '') +
-        ' so Postgres stops every request that touches it with ' + loopError(finding) + '. I saw it when using ' +
-        listOf((finding.reads || []).map((t) => '"' + t + '"')) + '.',
-      '',
-      'Show me the policies on "' + finding.table + '" and on every table whose policy reads "' +
-        finding.table + '", and find the lookup that goes back into "' + finding.table + '".',
-      '',
-      'Move that lookup into a SECURITY DEFINER function that answers only about the signed-in ' +
-        'user - for example is_member_of(org uuid) returning whether auth.uid() is in that ' +
-        'organization - with SET search_path fixed, owned by the table\'s owner so it reads the ' +
-        'table without the rule applying again. Grant EXECUTE on it to authenticated only. Then ' +
-        'make the policies call that function instead of reading "' + finding.table + '" directly.',
-      '',
-      'Keep each policy exactly as strict as it was meant to be: members see only their own ' +
-        'organization\'s rows, and logged-out visitors get nothing. Do not replace it with USING ' +
-        '(true) to make the error go away.',
-      '',
-      'Then sign in as an ordinary user and open the pages that use these tables, and run this ' +
-        'check again - the tables it could not test will be tested this time.',
-    ]
-    : finding.kind === 'role' && finding.takeover
-    ? [
-      'My app has a permissions problem - a member can take over another member\'s place.',
-      '',
-      'In my database, a member of ' + aOne(finding.parent) + ' whose role in "' + finding.via + '"."' +
-        finding.roleColumn + '" is "' + finding.who + '" can update another member\'s row in "' + finding.via +
-        '" and set "' + finding.personColumn + '" to their own id - taking that member\'s place and role, an ' +
-        'admin\'s or the owner\'s included. This was proved on a copy of the database.',
-      '',
-      'Fix the rules on "' + finding.via + '" that cover UPDATE or ALL: nobody may change "' + finding.personColumn +
-        '" or the team a membership belongs to on an existing row - adding or removing members is how membership ' +
-        'changes. Let only the roles that manage the team (usually owner and admin) update membership rows at ' +
-        'all, check that in WITH CHECK as well as USING, and never use WITH CHECK (true). If members only need to ' +
-        'change something of their own, allow exactly that column on their own row and nothing else.',
-      '',
-      'Then check every function that updates "' + finding.via + '" for the same thing.',
-    ]
-    : finding.kind === 'role' && finding.movein
-    ? [
-      'My app has a security problem - anyone signed in can make themselves ' + aRole(finding.toRole) + ' of any ' +
-        oneOf(finding.parent) + '.',
-      '',
-      'In my database, a signed-in user can update their own row in "' + finding.via + '" and change ' +
-        listOf((finding.moved || []).map((c) => '"' + c + '"')) + ' to another ' + oneOf(finding.parent) +
-        ' - one they were never invited to - and "' + finding.roleColumn + '" to "' + finding.toRole + '". The rule only ' +
-        'checks that the row is theirs, not what they change in it. This was proved on a copy of the database.',
-      '',
-      'Fix the rules on "' + finding.via + '" that cover UPDATE or ALL: nobody may change ' +
-        listOf((finding.moved || []).map((c) => '"' + c + '"')) + ' on an existing row, and a member must never be ' +
-        'able to change "' + finding.roleColumn + '" on their own row. Joining happens only by an invitation that ' +
-        'somebody who manages that ' + oneOf(finding.parent) + ' made. Let only the roles that manage the team change ' +
-        'membership rows, checked in WITH CHECK as well as USING - for example with a helper that reads "' + finding.via +
-        '" for auth.uid() and the row\'s own ' + listOf((finding.moved || []).map((c) => '"' + c + '"')) + '.',
-      '',
-      'Then check every function that updates "' + finding.via + '" for the same thing.',
-    ]
-    : finding.kind === 'role' && finding.promote
-    ? [
-      'My app has a security problem - a member can make themselves ' + aRole(finding.toRole) + '.',
-      '',
-      'In my database, a member of ' + aOne(finding.parent) + ' whose role in "' + finding.via + '"."' +
-        finding.roleColumn + '" is "' + finding.who + '" can update their own row in "' + finding.via + '" and set "' +
-        finding.roleColumn + '" to "' + finding.toRole + '". The rule only checks that the row is theirs, not what ' +
-        'they change in it. This was proved on a copy of the database.',
-      '',
-      'Fix the rules on "' + finding.via + '" that cover UPDATE or ALL: a member must never be able to change "' +
-        finding.roleColumn + '" on their own row. Let only the roles that manage the team (usually owner and admin) ' +
-        'change roles, checked in WITH CHECK as well as USING - for example with a helper that reads "' + finding.via +
-        '" for auth.uid() - and make sure nobody can raise anyone above their own role. If members need to edit ' +
-        'something else of their own, allow exactly those columns and not "' + finding.roleColumn + '".',
-      '',
-      'Then check every function that updates "' + finding.via + '" for the same thing.',
-    ]
-    : finding.kind === 'role'
-    ? [
-      'My app may have a permissions problem - please check it rather than assume it.',
-      '',
-      'In my database, a member of ' + aOne(finding.parent) + ' whose role in "' + finding.via + '"."' +
-        finding.roleColumn + '" is "' + finding.who + '" can ' +
-        listOf((finding.can || []).map((what) => ({ add: 'add', change: 'change', delete: 'delete' })[what])) +
-        ' rows of that ' + oneOf(finding.parent) + ' in the "' + finding.table + '" table. This was proved ' +
-        'on a copy of the database: ' + aRole(finding.who) + ' was added, and the writes went through.',
-      '',
-      'First tell me: should ' + aRole(finding.who) + ' be able to do that? If yes, change nothing.',
-      '',
-      'If not, make the rules on "' + finding.table + '" that cover UPDATE, DELETE, INSERT or ALL check ' +
-        'the member\'s role as well as membership - for example with a helper that reads "' + finding.via +
-        '" for auth.uid() and the roles allowed to edit. Postgres lets a write through if ANY permissive ' +
-        'policy allows it, so a strict rule beside a loose one does nothing: list every such policy on "' +
-        finding.table + '" and narrow or drop the loose one. Keep the read rule as it is if ' +
-        aRole(finding.who) + ' should still see these rows.',
-      '',
-      'Then check every other table where members can write for the same thing.',
-    ]
-    : finding.kind === 'teamread'
-    ? [
-      'My app may have a permissions problem - please check it rather than assume it.',
-      '',
-      'In my database, a member of ' + aOne(finding.parent) + ' whose role in "' + finding.via + '"."' +
-        finding.roleColumn + '" is "' + finding.who + '" can read the "' + finding.table + '" table of that ' +
-        oneOf(finding.parent) + ', including ' + listOf((finding.secrets || []).map((c) => '"' + c + '"')) +
-        '. This was proved on a copy of the database: ' + aRole(finding.who) + ' was added, and the rows came back.',
-      '',
-      'First tell me: should ' + aRole(finding.who) + ' see these? If yes, change nothing.',
-      '',
-      'If not, make the rules on "' + finding.table + '" that cover SELECT or ALL check the member\'s role as ' +
-        'well as membership. Postgres lets a read through if ANY permissive policy allows it, so a strict rule ' +
-        'beside a loose one does nothing: list every such policy on "' + finding.table + '" and narrow or drop ' +
-        'the loose one. If members need the other columns, a view or function that leaves the secret ones out ' +
-        'is often the better fix.',
-      '',
-      'Then check every other table that holds tokens, keys, secrets or payloads for the same thing.',
-    ]
-    : finding.kind === 'bucket'
-    ? [
-      'My app may have a storage problem - please check it rather than assume it.',
-      '',
-      'The Supabase Storage bucket "' + finding.bucket + '" is public. Anyone with a file\'s URL can ' +
-        'download it without logging in' + (finding.noRule && (finding.writers || []).length
-        ? ', and no rule on storage.objects says who may read it - though ' +
-          listOf((finding.writers || []).map((r) => '"' + r + '"')) + ' let only signed-in members upload or delete ' +
-          'its files, which suggests they are not meant for everyone.'
-        : finding.noRule
-        ? ', and no rule on storage.objects says who may read it - its name suggests its files are not ' +
-          'meant for everyone.'
-        : ', and the storage.objects ' +
-          ((finding.rules || []).length === 1 ? 'policy that names' : 'policies that name') + ' this bucket (' +
-          listOf((finding.rules || []).map((r) => '"' + r + '"')) + ') ' +
-          ((finding.rules || []).length === 1 ? 'is' : 'are') + ' not checked for public URLs - so ' +
-          ((finding.rules || []).length === 1 ? 'it protects' : 'they protect') + ' nothing while it is public.'),
-      '',
-      'First tell me: is every file in this bucket meant to be downloadable by anyone? If yes, change nothing.',
-      '',
-      'If not, make the bucket private (in the Supabase dashboard: Storage, edit the bucket, turn Public ' +
-        'off - or UPDATE storage.buckets SET public = false WHERE id = \'' + finding.bucket + '\'). Then ' +
-        'change the app to fetch these files with signed URLs (createSignedUrl) instead of getPublicUrl, ' +
-        'or the links it shows will stop working.',
-      '',
-      finding.noRule
-        ? 'Once it is private, add a read rule on storage.objects for this bucket that lets in only the ' +
-          'people a file belongs to - without one, nobody but your server can read them.'
-        : 'Keep the read rule: once the bucket is private it is what decides who gets a file. Check that it ' +
-          'only lets in the right people.',
-      '',
-      'Then look at every other bucket for the same thing.',
-    ]
-    : finding.kind === 'searchpath'
-    ? [
-      'My app may have a security weakness - please check it rather than assume it.',
-      '',
-      'The database function "' + finding.fn + '(' + (finding.args || '') + ')" is SECURITY DEFINER ' +
-        '(it runs with its owner\'s rights) and does not set a search_path, so names inside it ' +
-        'without a schema are looked up along the caller\'s path.',
-      '',
-      'Fix only this: add SET search_path = \'\' to the function\'s definition, and write every ' +
-        'table, view and function it uses with its schema - public.scans, not scans; auth.uid() ' +
-        'stays as it is. Keep its body, its checks and its grants exactly as they are.',
-      '',
-      'Then call it once the way the app does, to make sure it still works, and look at every ' +
-        'other SECURITY DEFINER function for the same thing.',
-    ]
-    : finding.kind === 'conflict'
-    ? [
-      'My app has a broken database function.',
-      '',
-      'The function "' + finding.fn + '(' + (finding.args || '') + ')" runs INSERT INTO ' +
-        finding.target + ' ... ON CONFLICT (' + finding.on + '), and Postgres refuses it with ' +
-        '"there is no unique or exclusion constraint matching the ON CONFLICT specification" - so ' +
-        'it fails on every call.',
-      '',
-      finding.partialWhere
-        ? 'The unique index on (' + finding.on + ') is partial: WHERE ' + finding.partialWhere + '. ' +
-          'Repeat that condition in the function right after the conflict columns: ON CONFLICT (' +
-          finding.on + ') WHERE ' + finding.partialWhere + ' DO ... - and keep the rest of the ' +
-          'statement as it is. Do not drop the index\'s WHERE: it is what lets rows without a value exist.'
-        : 'Make the ON CONFLICT match a unique rule that exists: either add a unique constraint on ' +
-          finding.target + ' (' + finding.on + ') if those columns really must be unique together, or ' +
-          'change the conflict columns to an existing unique key. Tell me which you chose and why.',
-      '',
-      'Then call the function twice with the same values: the second call must update the row, ' +
-        'not error and not add a second one.',
-    ]
-    : finding.kind === 'nullcheck'
-    ? [
-      'My app may have a data problem - please check it rather than assume it.',
-      '',
-      'In the "' + finding.table + '" table, the column "' + finding.column + '" has a CHECK that ' +
-        'allows only ' + listOf((finding.allowed || []).map((v) => '\'' + v + '\'')) + ', but the column ' +
-        'can be empty (NULL), and a CHECK lets NULL through.',
-      '',
-      'First tell me: should every row have a ' + finding.column + '? If an empty one is meant to be ' +
-        'allowed, change nothing and say so.',
-      '',
-      'If every row should have one: set the empty ones first (UPDATE "' + finding.table + '" SET "' +
-        finding.column + '" = <the right value> WHERE "' + finding.column + '" IS NULL - ask me what ' +
-        'the right value is), then ALTER TABLE "' + finding.table + '" ALTER COLUMN "' + finding.column +
-        '" SET NOT NULL. Change nothing else.',
-    ]
-    : finding.kind === 'noinsert'
-    ? [
-      'My app may have a bug - please check it rather than assume it.',
-      '',
-      'In my database, the rule' + ((finding.rules || []).length === 1 ? ' ' : 's ') +
-        listOf((finding.rules || []).map((r) => '"' + r + '"')) + ' on "' + finding.table + '" for INSERT ' +
-        ((finding.rules || []).length === 1 ? 'has' : 'have') + ' no WITH CHECK, and there is no other rule that ' +
-        'allows adding rows. Postgres treats a missing check as false, so nobody can add a row to "' + finding.table +
-        '" - not even through a function that runs as the user.',
-      '',
-      'First tell me: is adding rows to "' + finding.table + '" meant to work for signed-in users? If only your ' +
-        'server adds them, change nothing.',
-      '',
-      'If users should be able to add them: give the rule a WITH CHECK that says who may - for example that ' +
-        'the user is a member of the row\'s organization (through your membership table or a helper) and that ' +
-        'the column naming who created it equals auth.uid(). Never use WITH CHECK (true): that lets anyone add ' +
-        'rows anywhere. Then add one row through the app to make sure it works.',
-    ]
-    : finding.kind === 'privileged'
-    ? [
-      'My app may have a security problem - please check it rather than assume it.',
-      '',
-      'The database function "' + finding.fn + '(' + (finding.args || '') + ')" is SECURITY ' +
-        'DEFINER, so it runs with its owner\'s rights and ignores row level security. It is ' +
-        'granted EXECUTE to "anon", so anyone who is not logged in can call it' +
-        (finding.writes ? ', and it writes to tables.' : '.'),
-      '',
-      'First tell me: is it meant to be callable by logged-out visitors? If it is not, ' +
-        'REVOKE EXECUTE ON FUNCTION "' + finding.fn + '"(' + (finding.args || '') + ') FROM anon, PUBLIC.',
-      '',
-      // Found on a blind test (Northstar): get_recent_findings(org id) was
-      // the app's own RPC for signed-in members, and "grant it to
-      // service_role" would have broken the page that calls it.
-      'Then decide who should run it. If signed-in users of the app call it, keep it granted to ' +
-        'authenticated and add a check at its top that the caller - auth.uid() - may act on what ' +
-        'they passed in, for example that they are a member (or an admin) of the organization ' +
-        'whose id it takes, and RAISE an exception otherwise. Only if nothing but your own server ' +
-        'calls it, grant it to service_role alone.',
-      '',
-    ].concat(
-      finding.nullSlips
-        ? [
-          'Its role check lets through anyone with no role at all: the helper returns NULL for them, and ' +
-            'NULL NOT IN (...) - or NULL <> ... - is not true, so the IF never raises. Write the check so ' +
-            'NULL cannot pass, for example IF coalesce(<the helper>(...), \'none\') NOT IN (...) THEN RAISE, ' +
-            'or IF <the helper>(...) IS NULL OR <the helper>(...) NOT IN (...) THEN RAISE - and check every ' +
-            'other function that uses the same helper the same way.',
-          '',
-        ]
-        : [],
-      finding.hasFixedSearchPath
-        ? []
-        : [
-          'It also does not set a fixed search_path. Add SET search_path = pg_catalog, public (or ' +
-            'the schemas it truly needs) so a caller cannot make it resolve names to their own objects.',
-          '',
-        ],
-      [
-        'If it is meant to be public, keep it, but make sure everything inside it checks what the ' +
-          'caller is allowed to see or change itself - the table rules will not do it here.',
-        '',
-        'Then look at every other SECURITY DEFINER function for the same grant.',
-      ],
-    )
-    : finding.kind === 'orphaned'
-    ? [
-      'My app has a data problem.',
-      '',
-      'The "' + finding.table + '" table has a "' + finding.column +
-        '" column that is meant to point at "' + finding.parent + '".' +
-        ' There is no foreign key between them, so the database does not know they ' +
-        'are related. I proved it by adding a row naming one that does not exist, ' +
-        'and it was accepted.',
-      '',
-      'Add a foreign key from "' + finding.table + '"."' + finding.column +
-        '" to "' + finding.parent + '"."' + finding.parentKey + '".',
-      '',
-      'Decide on purpose what should happen when the parent row is deleted: ON ' +
-        'DELETE CASCADE if the children should go too, ON DELETE SET NULL if they ' +
-        'should stay without an owner, or nothing at all if the delete should be ' +
-        'refused while children exist.',
-      '',
-      'There may already be rows pointing at nothing, and the constraint will not ' +
-        'be created until those are dealt with. Find them first.',
-    ]
-    : finding.kind === 'writable'
-    ? [
-      'My app has a security problem.',
-      '',
-      'The "' + finding.table + '" table can be written to by ' +
-        (finding.who === 'anyone' ? 'anyone who is not logged in' : 'any signed-in user, including other users rows') +
-        ', because ' + cause.short + '. I proved it: I ' +
-        (finding.can || []).map((what) => ({ add: 'added a row', change: 'changed rows', delete: 'deleted rows' })[what])
-          .join(', ') + '.',
-      '',
-    ].concat(
-      serverOnlyLines(finding) || [
-          switchOn(finding) + 'write separate rules for reading, inserting, updating and deleting. ' +
-            'A rule written FOR SELECT does not cover writes, and a rule written FOR ALL covers ' +
-            'far more than reading.',
-          '',
-          'For insert and update, use WITH CHECK comparing ' + owner +
-            ' to the id of the signed-in user, so nobody can write a row under somebody ' +
-            "else's name. For update and delete, add USING with the same comparison: " +
-            'with USING (true) left on the update, anyone can take a row that is not ' +
-            'theirs and rewrite it as their own.',
-          '',
-        ],
-      [
-        'Then check every other table for the same thing - a table with no row level ' +
-          'security on it is writable by default.',
-      ],
-    )
-    : finding.kind === 'duplicated'
-    ? [
-      'My app has a security problem.',
-      '',
-      'Two rows in the "' + finding.table + '" table can hold the same "' + finding.column +
-        '". I proved it by inserting the same value from two connections at the same ' +
-        'moment, and both were accepted.',
-      '',
-      // First, because it has to happen before anything is changed. Learned
-      // by applying the short version of this prompt literally to a real app:
-      // the constraint cannot be created while duplicates exist, and an
-      // assistant told only "add a constraint" may delete rows to get there.
-      'First, find the rows that already share a value and show them to me. Do not ' +
-        'delete or merge any of them without asking me: the rule below cannot be ' +
-        'created while they exist, and deleting rows to make it pass loses real data.',
-      '',
-      (finding.expectation === 'identity'
-        ? 'Then add a unique index on lower("' + finding.column + '"), so that "' + finding.table +
-          '"."' + finding.column + '" is unique whatever the case - Ann@example.com and ' +
-          'ann@example.com are the same person.'
-        : 'Then add a unique constraint on "' + finding.table + '"."' + finding.column + '".') +
-        ' It has to be in the database itself. Checking in application code before inserting ' +
-        'is not enough - between the check and the insert, the other request has already gone in.',
-      '',
-      // Said because the obvious fix is wrong for multi-tenant apps, and being
-      // told to drop a legitimate design would cost them more than the bug.
-      'If the same value is allowed to repeat for different owners, make it cover both ' +
-        'columns together rather than leaving it off.',
-      '',
-    ].concat(
-      [
-        'Find everything that writes this column - app code, and any database trigger or ' +
-          'function, such as one that copies each new sign-up into this table - and make ' +
-          'sure each one handles "this value already exists" instead of failing. If people ' +
-          'can edit this column themselves, decide whether they should: once it is unique, ' +
-          'someone who puts another person\'s value in first will block that person.',
-        '',
-      ],
-      finding.expectation === 'identity' && finding.loginElsewhere
-        ? [
-          'Sign-in uses auth.users, so this column is only a copy of the email there. ' +
-            'Consider not letting people edit it at all and keeping it in step with auth.users.',
-          '',
-        ]
-        : [],
-      [
-        'Afterwards, sign up a brand-new account and edit an existing profile to make sure ' +
-          'both still work, and run this check again.',
-        '',
-        'Then look for the same missing constraint on every other table and fix those too.',
-      ],
-    )
-    : finding.asRole
-      ? [
-        'My app has a security problem.',
-        '',
-        'In "' + finding.table + '", anyone who is "' + finding.asRole + '" in their own ' + oneOf(finding.parent) + ' can read the rows ' +
-          'of every ' + oneOf(finding.parent) + '. I proved it on a copy: as "' + finding.asRole + '" of one ' + oneOf(finding.parent) +
-          ', I read ' + finding.readable + ' row(s) of another.',
-        '',
-        'A rule on "' + finding.table + '" checks the caller\'s role without tying it to the row - for example ' +
-          'exists (select 1 from ' + finding.via + ' m where m.' + finding.roleColumn + ' = \'' + finding.asRole + '\') with no ' +
-          'condition that m is the signed-in user\'s membership of THIS row\'s ' + oneOf(finding.parent) + '. Fix every rule on "' +
-          finding.table + '": a role check must say m.user_id = auth.uid() AND m.<' + oneOf(finding.parent) + ' id> = the row\'s ' +
-          oneOf(finding.parent) + ' id - or call a helper that does. Keep membership as the way in; do not replace it with USING (true).',
-        '',
-        'Then check every other rule and helper that checks a role for the same missing link.',
-      ]
-      : finding.isView
-      ? [
-        'My app has a security problem.',
-        '',
-        'The "' + finding.table + '" view can be read by anyone who is not logged in. ' +
-          'A view runs with the rights of whoever created it, so the row level security ' +
-          'on the tables underneath is never checked against the person asking.',
-        '',
-        'Fix it by recreating the view with security_invoker set on, so it runs as the ' +
-          'visitor and the rules on the underlying tables apply - and make sure those ' +
-          'tables actually have those rules.',
-        '',
-        'Then check every other view in the app for the same thing.',
-      ]
-      : [
-        'My app has a security problem.',
-        '',
-        'The "' + finding.table + '" table ' +
-          (finding.kind === 'exposed'
-            ? 'can be read by anyone who is not logged in, because ' + cause.short + '.'
-            : finding.tenant
-              ? 'lets a signed-in user read rows belonging to a different organization, because ' + cause.short + '.'
-              : 'lets one signed-in user read rows belonging to a different user, because ' + cause.short + '.'),
-        '',
-      ].concat(
-        serverOnlyLines(finding) || [
-            'Fix it so a person can only read their own rows: compare ' + owner +
-              ' against the id of the signed-in user, and make sure logged-out visitors get nothing.',
-            '',
-          ],
-        ['Then look for the same mistake on every other table and fix those too.'],
-      );
-  // Wrapped here rather than by whoever prints it: this text is pasted into a
-  // chat box as often as it is read in a terminal, and an unwrapped paragraph
-  // is a wall in both.
-  return lines
-    .map((paragraph) => (paragraph ? wrapTo(paragraph, 72) : ['']))
-    .reduce((all, part) => all.concat(part), [])
-    .join('\n');
-}
-
-// Found and said, but never claimed as a break: the owner decides. Counted
-// apart in the report, never towards the exit code or a clean re-check.
-const TO_CHECK = ['privileged', 'role', 'teamread', 'bucket', 'searchpath', 'nullcheck', 'noinsert'];
-// Functions, said by their name rather than a table's.
-const ON_A_FUNCTION = ['privileged', 'searchpath', 'conflict'];
-
-/** Everything the report needs about one thing the attack found. */
-function describe(finding) {
-  const contents = readContents(finding.columns);
-  const cause = causeOf(finding);
-  return {
-    severity: severityOf(finding, contents),
-    // Every other finding here was proven by an attack that ran; this is the
-    // one the tool reasons about without executing, so it says so. The report
-    // and the re-check both read this: a "verification required" finding is
-    // never counted towards a clean re-check on its own.
-    status: TO_CHECK.includes(finding.kind) && !(finding.kind === 'role' && finding.promote) ? 'verification required' : 'confirmed',
-    table: ON_A_FUNCTION.includes(finding.kind) ? finding.fn : finding.table,
-    fn: finding.fn,
-    args: finding.args,
-    writes: finding.writes,
-    kind: finding.kind,
-    // Carried through because a table can have two different columns that each
-    // accept a duplicate, and the re-check tells one finding from another by
-    // what it is about. Without the column they would share an identity and
-    // fixing one would look like fixing both.
-    column: finding.column,
-    parent: finding.parent,
-    parentKey: finding.parentKey,
-    expectation: finding.expectation,
-    headline: headlineFor(finding, contents),
-    body: bodyFor(finding, contents),
-    // For a privileged function there is no "why the door is open" the way a
-    // table has one; the body already carries the whole explanation, so the
-    // cause line would only repeat it. Left empty and skipped by the report.
-    cause: TO_CHECK.includes(finding.kind) || finding.kind === 'conflict' ? '' : cause.long,
-    who: finding.who,
-    can: finding.can,
-    via: finding.via,
-    roleColumn: finding.roleColumn,
-    readable: finding.readable,
-    secrets: finding.secrets,
-    bucket: finding.bucket,
-    rules: finding.rules,
-    // An organization's rows read from outside it, and a member taking over
-    // another member's row: kept so the re-check and the read-back word them
-    // the same way the report did.
-    tenant: finding.tenant,
-    asRole: finding.asRole,
-    takeover: finding.takeover,
-    personColumn: finding.personColumn,
-    promote: finding.promote,
-    movein: finding.movein,
-    moved: finding.moved,
-    toRole: finding.toRole,
-    nullSlips: finding.nullSlips,
-    noRule: finding.noRule,
-    writers: finding.writers,
-    // Read from how a function or column is declared (scan.js searchPathsOf,
-    // conflictsIn, emptyChoicesOf); kept so the read-back says it the same way.
-    target: finding.target,
-    on: finding.on,
-    partialWhere: finding.partialWhere,
-    allowed: finding.allowed,
-    anon: finding.anon,
-    proof: finding.kind === 'searchpath'
-      ? 'I did not call "' + finding.fn + '". I read that it is SECURITY DEFINER with no search_path set.'
-      : finding.kind === 'conflict'
-      ? 'I asked Postgres to plan its INSERT INTO ' + finding.target + ' ... ON CONFLICT (' + finding.on +
-        ') on the copy, and it refused. I did not call the function.'
-      : finding.kind === 'nullcheck'
-      ? 'I read that "' + finding.table + '.' + finding.column + '" may be NULL and has no default. I did not insert anything.'
-      : finding.kind === 'noinsert'
-      ? 'I read that every rule for adding rows to "' + finding.table + '" (' + listOf((finding.rules || []).map((r) => '"' + r + '"')) +
-        ') has neither USING nor WITH CHECK. I did not insert anything.'
-      : finding.kind === 'recursive'
-      ? 'Using ' + listOf((finding.reads || []).map((t) => '"' + t + '"')) + ' stopped with ' +
-        loopError(finding) + '.'
-      : finding.kind === 'privileged'
-      ? 'I did not call "' + finding.fn + '". This is a reach that exists in the grants, not a break I ran.'
-      : finding.kind === 'role' && finding.takeover
-      ? 'As ' + aRole(finding.who) + ' who had just joined, I put my own id on the other person\'s row of "' +
-        finding.via + '", which I could not touch before joining. It was undone.'
-      : finding.kind === 'role' && finding.movein
-      ? 'Signed in, and not a member, I moved my own row of "' + finding.via + '" into the other ' + oneOf(finding.parent) +
-        ' with "' + finding.roleColumn + '" set to "' + finding.toRole + '". It was undone.'
-      : finding.kind === 'role' && finding.promote
-      ? 'As ' + aRole(finding.who) + ' who had just joined, I set "' + finding.roleColumn + '" on my own row of "' +
-        finding.via + '" to "' + finding.toRole + '". It was undone.'
-      : finding.kind === 'crossed' && finding.asRole
-      ? 'As "' + finding.asRole + '" of my own ' + oneOf(finding.parent) + ', I read ' + finding.readable + ' row(s) of "' +
-        finding.table + '" belonging to another; with an ordinary role, none. My role was put back.'
-      : finding.kind === 'role'
-      ? 'As ' + aRole(finding.who) + ' who had just joined, I ' +
-        listOf((finding.can || []).map((what) => {
-          const n = (finding.changed || {})[what] || 1;
-          return ({ add: 'added ', change: 'changed ', delete: 'deleted ' })[what] + n + (n === 1 ? ' row' : ' rows');
-        })) + ' in "' + finding.table + '" that I could not touch before joining. All of it was undone.'
-      : finding.kind === 'teamread'
-      ? 'As ' + aRole(finding.who) + ' who had just joined, I read ' + (finding.readable || 1) +
-        ((finding.readable || 1) === 1 ? ' row' : ' rows') + ' of "' + finding.table + '" that I could not read before joining.'
-      : finding.kind === 'bucket' && finding.noRule
-      ? 'I read that "' + finding.bucket + '" is public and that no rule says who may read it' +
-        ((finding.writers || []).length ? ', while ' + listOf((finding.writers || []).map((r) => '"' + r + '"')) +
-          ' limit uploads and deletes to signed-in members' : '') + '. I did not open any file.'
-      : finding.kind === 'bucket'
-      ? 'I read that "' + finding.bucket + '" is public and that ' + listOf((finding.rules || []).map((r) => '"' + r + '"')) +
-        ' says who may read it. I did not open any file.'
-      : finding.kind === 'duplicated'
-      ? 'I created ' + finding.copies + ' rows in "' + finding.table + '" holding the same ' +
-        finding.column + '.'
-      : finding.countOnly
-      ? 'I counted ' + finding.readable + ' ' + (finding.readable === 1 ? 'row' : 'rows') +
-        ' in "' + finding.table + '" that a stranger can read, without pulling any of them out.'
-      : 'I read ' + finding.readable + ' ' + (finding.readable === 1 ? 'row' : 'rows') +
-        ' from "' + finding.table + '" that should not have been readable.',
-    fixPrompt: fixPromptFor(finding),
-    contents: contents,
-  };
-}
-
-/** Everything wrong with one table's rules, said once. */
-function mergeTable(group, one) {
-  const members = group.map(one);
-  const read = group.find((m) => m.kind === 'exposed');
-  const anyoneWrites = group.find((m) => m.kind === 'writable' && m.who === 'anyone');
-  const customersWrite = group.find((m) => m.kind === 'writable' && m.who !== 'anyone');
-  const lead = anyoneWrites || customersWrite || read;
-  const leadItem = members[group.indexOf(lead)];
-  const table = lead.table;
-  const order = ['delete', 'change', 'add'];
-  const does = (w) => order.filter((m) => (w.can || []).includes(m)).map((m) => WRITE_WORDS[m]);
-  let headline;
-  if (read && anyoneWrites) {
-    const verbs = ['read'].concat(order.filter((m) => (anyoneWrites.can || []).includes(m)));
-    headline = 'Anyone can ' + listOf(verbs) + ' rows in your ' + table + ' table.';
-  } else if (read && customersWrite) {
-    headline = 'Anyone can read your ' + table + ' table, and any signed-in customer can ' + listOf(does(customersWrite)) + ' it.';
-  } else {
-    headline = leadItem.headline;
-  }
-  // The customers' part is said in one line when strangers can already do it.
-  const bodies = [];
-  for (let i = 0; i < group.length; i++) {
-    if (group[i] === customersWrite && anyoneWrites) continue;
-    bodies.push(members[i].body);
-  }
-  if (customersWrite && anyoneWrites) bodies.push('Signed-in customers can do the same.');
-  const severity = members.some((m) => m.severity === 'CRITICAL') ? 'CRITICAL' : leadItem.severity;
-  const can = [];
-  for (const m of group) for (const c of m.can || []) if (!can.includes(c)) can.push(c);
-  return Object.assign({}, leadItem, {
-    severity: severity,
-    status: 'confirmed',
-    kind: lead.kind,
-    who: read || anyoneWrites ? 'anyone' : leadItem.who,
-    can: can,
-    headline: headline,
-    body: bodies.join(' '),
-    proof: members.map((m) => m.proof).join(' '),
-    fixPrompt: groupPromptFor(group),
-    members: members,
-  });
-}
-
-/** The whole report, in the order a person should read it. */
-function describeAll(findings) {
-  // A table anyone can read is also, necessarily, a table one customer can read
-  // of another. Reporting both puts the same table on screen twice and turns
-  // two problems into a list of three that reads like a mistake. The public one
-  // is kept, and it carries the rest.
-  const raw = findings || [];
-  const publiclyOpen = new Set(raw.filter((f) => f.kind === 'exposed').map((f) => f.table));
-  const kept = raw.filter((f) => !(f.kind === 'crossed' && publiclyOpen.has(f.table)));
-  const one = (f) => {
-    const item = Object.assign(describe(f), {
-      alsoCrossed: f.kind === 'exposed' && raw.some((o) => o.kind === 'crossed' && o.table === f.table),
-    });
-    if (item.alsoCrossed) item.body += ' Your signed-in customers can read each other\'s rows for the same reason.';
-    return item;
-  };
-
-  // One table, one finding. A single rule written FOR ALL USING (true) opens a
-  // table to reading and writing, for strangers and customers alike - four
-  // proofs of one mistake. Listed as four, a real app's report showed six
-  // CRITICAL findings for two rules, and the person reads six problems where
-  // there are two to fix. The proofs are kept as members, so a re-check can
-  // still tell "strangers can no longer write" from "strangers can still read".
-  const grouped = new Map();
-  for (const f of kept) {
-    if ((f.kind !== 'exposed' && f.kind !== 'writable') || f.isView || f.countOnly) continue;
-    if (!grouped.has(f.table)) grouped.set(f.table, []);
-    grouped.get(f.table).push(f);
-  }
-  const described = [];
-  const done = new Set();
-  for (const f of kept) {
-    const group = grouped.get(f.table);
-    if (!group || group.length < 2 || group.indexOf(f) === -1) {
-      described.push(one(f));
-      continue;
-    }
-    if (done.has(f.table)) continue;
-    done.add(f.table);
-    described.push(mergeTable(group, one));
-  }
-  // Worst first, and within that the ones open to the whole internet before the
-  // ones that need an account, and those before the ones that need two requests
-  // to arrive together.
-  // Writes above reads: a table somebody emptied is worse than one they read.
-  // A looping rule sits with the reads: it breaks the app for everyone it
-  // fails for, which matters more than a duplicate or a stray row.
-  const byKind = { writable: 0, exposed: 1, crossed: 2, recursive: 2.5, conflict: 2.6, duplicated: 3, orphaned: 4, role: 4.5, teamread: 4.6, bucket: 4.7, privileged: 5, searchpath: 5.5, noinsert: 5.7, nullcheck: 6 };
-  const rank = (d) => (d.severity === 'CRITICAL' ? 0 : 1) * 10 + (byKind[d.kind] === undefined ? 9 : byKind[d.kind]);
-  return described.sort((a, b) => rank(a) - rank(b));
-}
-
-/** What is printed when a run finds nothing. Silence would read as a failure. */
-function allClearLines(attacksRun) {
-  // Nothing attacked is not the same as nothing got through. The callers all
-  // stop before this now, but the sentence is the one thing in the product
-  // that must never be printed by accident, so it guards itself too.
-  if (!attacksRun) {
-    return ['', '  I did not manage to attack anything, so there is nothing to report.', ''];
-  }
-  // "Your data held" used to be the last line here, and it was the wrong
-  // sentence: it says something about the app, and all this program knows is
-  // something about the attacks it happened to run. A person who reads "your
-  // data held" stops looking. A person who reads "these attacks lost" knows
-  // what they have been handed and what they have not.
-  return [
-    '',
-    '  Nothing got through.',
-    '',
-    '  I ran ' + attacksRun + ' ' + (attacksRun === 1 ? 'attack' : 'attacks') + ' against a copy of your app,',
-    '  and every one of them lost.',
-    '',
-    '  That is not the same as "your app is safe". It means these attacks,',
-    '  against this shape of database, this time, did not get in. Anything I',
-    '  did not try is listed at the end.',
-    '',
-  ];
-}
-
-module.exports = {
-  authTiesOf: authTiesOf,
-  readContents: readContents,
-  severityOf: severityOf,
-  causeOf: causeOf,
-  describe: describe,
-  describeAll: describeAll,
-  fixPromptFor: fixPromptFor,
-  allClearLines: allClearLines,
-  listOf: listOf,
-};
+// Turning what the attack saw into something a person can act on.
+//
+// The detection is the easy tenth. A builder who cannot read code does not buy
+// "crossed:customers:1" - they buy knowing their customer list is open, seeing
+// it happen, and having one thing to paste that closes it.
+//
+// The rule everything here follows: never say more than was actually seen. If
+// the attack read a table with an email column in it, say email. If it did not,
+// do not reach for "personal details" because it sounds more urgent. A report
+// that overstates once is a report nobody trusts again, and trust is the entire
+// product - the re-check at the end is worth exactly as much as the first
+// report was honest.
+
+/* --------------------------------------------------------------------------
+   What was in the table.
+-------------------------------------------------------------------------- */
+
+// Things that identify a person. Matched on whole words so that `company_name`
+// counts and `renamed_at` does not.
+const IDENTITY = [
+  [/\b(email|e_mail|mail)\b/i, 'email addresses'],
+  [/\b(phone|mobile|contact_number|telephone)\b/i, 'phone numbers'],
+  // `\b` treats "_" as part of a word, so display_name never matched `name` -
+  // found on a blind test, where a public profiles table was reported as
+  // holding nothing in particular. The compound names are listed instead.
+  [/\b(full_name|first_name|last_name|given_name|surname|name|display_name|username|user_name|nickname|screen_name)\b/i, 'names'],
+  [/\b(address|street|city|postcode|zip|pincode)\b/i, 'addresses'],
+  [/\b(dob|date_of_birth|birth_date|birthday)\b/i, 'dates of birth'],
+];
+
+// Things that are worse than identifying - they let somebody act as the person,
+// or take money.
+const SECRETS = [
+  // `\b` counts "_" as a letter, so these missed every compound name - found
+  // on a blind test: integration_token, access_token and signing_secret, all
+  // readable by anyone, and the report named none of them. A name that ENDS
+  // in the secret word is the secret; token_expires_at is only about one.
+  // Singular only: `tokens` and `input_tokens` count what an AI call used -
+  // found on the next blind test, where api_usage.tokens (an integer) was
+  // named as a secret.
+  [/\b(password|passwd|pass_hash|password_hash)\b|(^|_)(password|passwd|pwd|password_hash)$/i, 'passwords'],
+  [/\b(token|api_key|apikey|secret|private_key|access_key)\b|(^|_)(token|secret|(api|private|access|secret|signing|service|encryption)_?key)$/i, 'access tokens and secrets'],
+  [/\b(card|card_number|cvv|iban|account_number|upi)\b/i, 'payment details'],
+  // A code that grants something: whoever reads a moderator_code can become a
+  // moderator. Found on a blind test, added straight in production and readable
+  // by anyone - reported only as "2 rows".
+  [/^(?:\w+_)?(moderator|invite|invitation|access|reset|verification|recovery|admin|join|auth|login|magic|security|otp)_code$|^(otp|pin)$/i, 'secret codes'],
+];
+
+// Who holds power in the app. Not a secret in itself, but a list of exactly
+// which accounts are worth attacking.
+const PRIVILEGE = [/^(is_admin|is_superuser|is_super_admin|is_staff|is_moderator|is_owner|role|roles|permissions)$/i, 'who is an admin'];
+
+const MONEY = [/\b(amount|total|price|balance|salary|revenue|invoice)\b/i, 'amounts of money'];
+
+// Each kind named with the columns that showed it: "secret codes
+// (moderator_code)" can be found in the table; "secret codes" has to be
+// looked for.
+
+/**
+ * A function's name as SQL: "fn", or "other"."fn" for one in a schema of the
+ * app's other than the one scanned (blind round 17, DB-04) - "other.fn" in
+ * one pair of quotes would name a function that does not exist.
+ */
+function quotedFunction(name) {
+  const text = String(name || '');
+  const dot = text.indexOf('.');
+  const quote = (part) => '"' + part.split('"').join('""') + '"';
+  return dot > 0 ? quote(text.slice(0, dot)) + '.' + quote(text.slice(dot + 1)) : quote(text);
+}
+function matched(columns, table) {
+  const names = (columns || []).map(String);
+  const found = [];
+  for (const [pattern, label] of table) {
+    const hits = names.filter((column) => pattern.test(column));
+    if (hits.length) found.push(label + ' (' + hits.join(', ') + ')');
+  }
+  return found;
+}
+
+/** What a table holds, in the words a person would use. */
+function readContents(columns) {
+  const identity = matched(columns, IDENTITY);
+  const secrets = matched(columns, SECRETS);
+  const money = matched(columns, [MONEY]);
+  const privilege = matched(columns, [PRIVILEGE]);
+  return { identity: identity, secrets: secrets, money: money, privilege: privilege };
+}
+
+/** Everything worth naming, worst first. */
+function heldIn(contents) {
+  return contents.secrets.concat(contents.identity, contents.privilege || [], contents.money);
+}
+
+/**
+ * A table anyone can read that may be meant to be public (blind round 17,
+ * DEC-03): nothing on a row says whose it is - no person, no team - and no
+ * column looks personal, secret, money or a role. A price list, a blog. Said
+ * as a question, never as HIGH. Not a view: a view can leave out the column
+ * that says whose the rows underneath are.
+ */
+function publicByDesign(finding) {
+  if (finding.kind !== 'exposed' || finding.nobodys !== true || finding.isView || finding.countOnly) return false;
+  // On a row that is nobody's, a bare name is a thing's name (a product's),
+  // and a price is what the list is for. A person's email, phone, address or
+  // username, a secret, or who is an admin, still is not public by design -
+  // a waitlist of emails is a leak whoever's rows they are.
+  const columns = (finding.columns || []).filter((c) => !/^(name|title)$/i.test(String(c)));
+  const contents = readContents(columns);
+  return contents.identity.length + contents.secrets.length + (contents.privilege || []).length === 0;
+}
+
+/** A list, written the way a person writes one. */
+function listOf(items) {
+  const list = items.filter(Boolean);
+  if (!list.length) return '';
+  if (list.length === 1) return list[0];
+  return list.slice(0, -1).join(', ') + ' and ' + list[list.length - 1];
+}
+
+/** One of a table's things: workspaces -> workspace, companies -> company. */
+/** A role, quoted, with its article: a "viewer", an "analyst". */
+function aRole(role) {
+  return (/^[aeiou]/i.test(String(role)) ? 'an "' : 'a "') + role + '"';
+}
+
+/** The first letter made a capital, for the start of a sentence. */
+function capital(text) {
+  return text.charAt(0).toUpperCase() + text.slice(1);
+}
+
+/** The same, with its article: a workspace, an organization. */
+function aOne(table) {
+  const one = oneOf(table);
+  return (/^[aeiou]/i.test(one) ? 'an ' : 'a ') + one;
+}
+
+function oneOf(table) {
+  return String(table || 'team').replace(/ies$/, 'y').replace(/s$/, '');
+}
+
+/* --------------------------------------------------------------------------
+   How bad it is.
+-------------------------------------------------------------------------- */
+
+/**
+ * Severity, decided by what could be read rather than by how it was read.
+ *
+ * Only two levels on purpose. A scale of five invites the reader to skim past
+ * the bottom three, and everything the night shift reports is something that
+ * should be fixed - there is no such thing as a low finding here.
+ */
+function severityOf(finding, contents) {
+  if (finding.kind === 'recursive') {
+    // Nothing leaks and nothing is written: the request fails. Serious,
+    // because the app is broken for whoever it fails for, but not a break-in.
+    return 'HIGH';
+  }
+  // A member who can make themselves the owner: never the design, and the
+  // owner's reach is everything - the one role finding that is confirmed.
+  if (finding.kind === 'role' && finding.promote) return 'CRITICAL';
+  if (finding.kind === 'role' || finding.kind === 'teamread' || finding.kind === 'bucket') {
+    // Something to check, never a confirmed break: whether a viewer may edit,
+    // or a bucket may be public, is the owner's decision. So never CRITICAL.
+    return 'HIGH';
+  }
+  if (finding.kind === 'conflict' || finding.kind === 'searchpath' || finding.kind === 'nullcheck' || finding.kind === 'noinsert') {
+    // Read from how a function or a column is declared. A refused upsert
+    // breaks the app for whoever calls it; an open search_path and an empty
+    // value are for the owner to weigh. None of them hands a row to anybody.
+    return 'HIGH';
+  }
+  if (finding.kind === 'privileged') {
+    // Not proven, so never CRITICAL: this is a reach that exists, not a break
+    // that was demonstrated. A function anon can call that also writes is worth
+    // more attention than one that only reads, but both stay HIGH and both
+    // carry "verification required" - the person has to say whether the anon
+    // call was intended.
+    return 'HIGH';
+  }
+  if (finding.kind === 'orphaned') {
+    // Nothing is exposed and nothing is destroyed, so this is not the same
+    // order of thing as a table anyone can empty. It stays serious because
+    // the data it strands is data somebody asked to have deleted.
+    return 'HIGH';
+  }
+  if (finding.kind === 'writable') {
+    // Deleting and rewriting are unrecoverable in a way that reading is not:
+    // a leak is bad, but a customer table somebody emptied is gone. Being able
+    // only to add rows is serious and not the same thing.
+    const canDestroy = (finding.can || []).some((what) => what === 'delete' || what === 'change');
+    return canDestroy ? 'CRITICAL' : 'HIGH';
+  }
+  if (finding.kind === 'duplicated') {
+    // Judged by what the duplicate lets somebody do, not by what else sits in
+    // the table. A second row holding the same session token is critical even
+    // if the table has nothing personal in it at all.
+    if (finding.expectation === 'credential') return 'CRITICAL';
+    // Critical only while this column could be the login itself. When the
+    // database has Supabase's auth.users, sign-in goes through that table,
+    // which keeps every email unique - so a duplicate here is a copy that
+    // disagrees with itself, not two accounts sharing one login. Found on a
+    // real app: the report said "two accounts can answer to the same login"
+    // about a profiles table the login never read.
+    if (finding.expectation === 'identity') return finding.loginElsewhere ? 'HIGH' : 'CRITICAL';
+    return 'HIGH';
+  }
+  // Maybe public on purpose: a question for the owner, not a HIGH.
+  if (publicByDesign(finding)) return 'MEDIUM';
+  if (contents.secrets.length) return 'CRITICAL';
+  if (contents.identity.length) return 'CRITICAL';
+  return 'HIGH';
+}
+
+/* --------------------------------------------------------------------------
+   Saying it.
+-------------------------------------------------------------------------- */
+
+/**
+ * Why the door was open - and these two are genuinely different problems.
+ *
+ * Row level security switched off is an oversight. Switched on with a policy
+ * that lets everybody through is worse, because the dashboard shows the table
+ * as protected and the person has already been told they are safe. Saying which
+ * one it is saves them looking in the wrong place.
+ */
+function causeOf(finding) {
+  if (finding.kind === 'recursive') {
+    return {
+      short: 'a rule on it looks the same table up again',
+      long:
+        'A row level security rule on this table checks something by reading ' +
+        'this same table - usually "is this person a member?" asked of the ' +
+        'members table itself. Reading the table means applying the rule, and ' +
+        'applying the rule means reading the table, so Postgres stops the ' +
+        'request with an error instead of going round forever. Any other ' +
+        'table whose rule asks this one fails the same way.',
+    };
+  }
+  if (finding.kind === 'orphaned') {
+    return {
+      short: 'nothing in the database ties the two tables together',
+      long:
+        'There is no foreign key between these two tables, so the database has '+
+        'no idea they are related. It will not refuse a row that points at '+
+        'nothing, it will not stop somebody being deleted while their rows are '+
+        'still here, and it will never find these rows again afterwards.',
+    };
+  }
+  if (finding.kind === 'writable' && finding.isView) {
+    // Written through a view (blind round 17, DB-09): the rules on the table
+    // are right, and the view walks past them.
+    return {
+      short: 'a view writes with its creator\'s rights, not the visitor\'s',
+      long:
+        'This is a view, and a view runs as whoever created it unless it is ' +
+        'told otherwise. A plain view over one table can be written through, ' +
+        'so adding, changing and deleting rows of "' + finding.base + '" through ' +
+        'it is checked against the creator, not against the person asking - and ' +
+        'the rules you wrote on "' + finding.base + '" do not apply here at all.',
+    };
+  }
+  if (finding.kind === 'writable') {
+    if (finding.rlsEnabled) {
+      // Which rule let it through, from what is actually on the table rather
+      // than from an assumption.
+      //
+      // This branch used to say, of every writable table with row level
+      // security on, that its rule "covers every command rather than only
+      // reading". Measured against a table whose only policy was written FOR
+      // INSERT, that sentence was false twice over: the rule covered one
+      // command, and there was no rule letting anybody read at all. The
+      // finding was proved; the reason was invented. A report that overstates
+      // once is believed never again, so the reason is now read, not guessed.
+      const rules = (finding.rules || []).map((rule) => String(rule).toUpperCase());
+      const WRITTEN_FOR = { add: 'INSERT', change: 'UPDATE', 'delete': 'DELETE' };
+      const IN_WORDS = { INSERT: 'adding rows', UPDATE: 'changing rows', DELETE: 'deleting rows' };
+      const named = [];
+      for (const move of finding.can || []) {
+        const command = WRITTEN_FOR[move];
+        if (command && rules.includes(command) && !named.includes(command)) named.push(command);
+      }
+
+      if (rules.includes('ALL')) {
+        return {
+          short: 'the rule on it covers every command, not only reading',
+          long:
+            'The table has row level security switched on, but the rule attached ' +
+            'to it is written FOR ALL - so the same rule that decides who may ' +
+            'see a row also decides who may add, change and delete one, and it ' +
+            'is letting this through.',
+        };
+      }
+
+      if (named.length) {
+        return {
+          short: 'the rule you wrote for ' + listOf(named.map((c) => IN_WORDS[c])) +
+            ' lets everybody through',
+          long:
+            'The table has row level security switched on, and there is a rule on ' +
+            'it written for ' + listOf(named.map((c) => IN_WORDS[c])) + '. That ' +
+            'rule is the one letting this through: it does not check who is ' +
+            'asking, so it accepts the request from a stranger exactly as it ' +
+            'would from the person the row belongs to.',
+        };
+      }
+
+      // Row level security on, and no permissive rule that names this write.
+      // It should not have been possible, and saying which rule did it would
+      // be inventing one. What is certain is what was done, and that is all
+      // this says.
+      return {
+        short: 'row level security is on, and something let this through anyway',
+        long:
+          'The table has row level security switched on, and none of the rules on ' +
+          'it are written for this kind of write - so this should have been ' +
+          'refused and was not. Check whether the role your app connects as owns ' +
+          'the table or has BYPASSRLS, because either of those goes round every ' +
+          'rule you have written.',
+      };
+    }
+    return {
+      short: 'row level security was never switched on',
+      long:
+        'Row level security has never been switched on for this table. Supabase ' +
+        'grants insert, update and delete on the public schema by default, and ' +
+        'row level security is what takes them back - so until it is on, those ' +
+        'permissions are simply in force.',
+    };
+  }
+  if (finding.isView) {
+    // The one people are caught by, because everything looks right. The table
+    // is protected, the policy is correct, the dashboard is green - and the
+    // view hands the rows out anyway.
+    return {
+      short: 'a view reads with its creator\'s rights, not the visitor\'s',
+      long:
+        'This is a view, and a view runs as whoever created it unless it is ' +
+        'told otherwise. So any row level security on the tables underneath is ' +
+        'checked against the creator, not against the person asking - and the ' +
+        'rules you wrote on those tables do not apply here at all.',
+    };
+  }
+  if (finding.kind === 'duplicated') {
+    return {
+      short: 'nothing in the database makes it unique',
+      long:
+        'There is no unique constraint and no unique index on this column, so ' +
+        'the database has no way to refuse the second one. Checking in your app ' +
+        'code before inserting does not close this: between the check and the ' +
+        'insert, the other request has already been accepted.',
+    };
+  }
+  if (finding.rlsEnabled) {
+    return {
+      short: 'the rule that guards it lets everybody through',
+      long:
+        'The table has row level security switched on, so it looks protected, ' +
+        'but the rule attached to it allows every request. That is why nothing ' +
+        'in your dashboard flags it.',
+    };
+  }
+  return {
+    short: 'it has no protection switched on at all',
+    long:
+      'Row level security has never been switched on for this table, so every ' +
+      'rule you might have written elsewhere does not apply to it.',
+  };
+}
+
+/** What a caller could do, written the way a person would say it. */
+const WRITE_WORDS = { add: 'add rows to', change: 'change rows in', delete: 'delete rows from' };
+
+/**
+ * The error a looping rule produces, as Postgres words it. A rule that reads
+ * its own table directly is caught as recursion and named; one that reaches
+ * it through a helper function runs out of stack, and Postgres names nothing.
+ */
+function loopError(finding) {
+  return finding.deep
+    ? '"stack depth limit exceeded"'
+    : '"infinite recursion detected in policy for relation ' + finding.table + '"';
+}
+
+/** Who a looping rule fails for, said the way the headline and body need it. */
+function loopVictims(finding) {
+  const callers = finding.callers || [];
+  if (callers.includes('anyone') && callers.includes('signed-in')) return 'everyone, signed in or not,';
+  if (callers.includes('anyone')) return 'visitors who are not logged in';
+  return 'signed-in users';
+}
+
+function headlineFor(finding) {
+  if (finding.kind === 'recursive') {
+    return 'A rule on your ' + finding.table + ' table refers to itself, so ' + loopVictims(finding) +
+      ' get an error instead of data.';
+  }
+  if (finding.kind === 'orphaned') {
+    return 'Your ' + finding.table + ' table can point at a ' +
+      finding.parent.replace(/s$/, '') + ' that does not exist.';
+  }
+  if (finding.kind === 'writable') {
+    // Worst first, because the headline is often all that gets read.
+    const order = ['delete', 'change', 'add'];
+    const does = order.filter((what) => (finding.can || []).includes(what)).map((what) => WRITE_WORDS[what]);
+    return (finding.who === 'anyone' ? 'Anyone' : 'Any signed-in customer') + ' can ' +
+      listOf(does) + ' your ' + (finding.isView ? finding.base + ' table through your ' + finding.table + ' view.' : finding.table + ' table.');
+  }
+  if (finding.kind === 'duplicated') {
+    return 'Your ' + finding.table + ' table lets the same ' + finding.column + ' exist twice.';
+  }
+  if (finding.kind === 'privileged') {
+    return 'Anyone on the internet can call your ' + finding.fn + ' function, and it runs with full rights.';
+  }
+  if (finding.kind === 'searchpath') {
+    return 'Your ' + finding.fn + ' function runs with full rights but does not pin its search_path.';
+  }
+  if (finding.kind === 'conflict') {
+    return 'Your ' + finding.fn + ' function fails every time it saves: Postgres refuses its ON CONFLICT.';
+  }
+  if (finding.kind === 'nullcheck') {
+    return 'Your ' + finding.table + ' table accepts rows with no ' + finding.column + ' at all.';
+  }
+  if (finding.kind === 'noinsert') {
+    return 'Nobody can add a row to your ' + finding.table + ' table: its rule for adding rows checks nothing, and Postgres reads that as no.';
+  }
+  if (finding.kind === 'role' && finding.takeover) {
+    return capital(aRole(finding.who)) + ' in ' + aOne(finding.parent) + ' can take another member\'s place in your ' +
+      finding.table + ' table - and with it their role.';
+  }
+  if (finding.kind === 'role' && finding.movein) {
+    return 'Anyone signed in can make themselves ' + aRole(finding.toRole) + ' of any ' + oneOf(finding.parent) +
+      ' by moving their own row in your ' + finding.table + ' table into it.';
+  }
+  if (finding.kind === 'role' && finding.promote) {
+    return capital(aRole(finding.who)) + ' in ' + aOne(finding.parent) + ' can make themselves ' + aRole(finding.toRole) +
+      ' by changing their own row in your ' + finding.table + ' table.';
+  }
+  if (finding.kind === 'role') {
+    const order = ['delete', 'change', 'add'];
+    const does = order.filter((what) => (finding.can || []).includes(what)).map((what) => WRITE_WORDS[what]);
+    return capital(aRole(finding.who)) + ' in ' + aOne(finding.parent) + ' can ' + listOf(does) + ' your ' +
+      finding.table + ' table.';
+  }
+  if (finding.kind === 'teamread') {
+    return capital(aRole(finding.who)) + ' in ' + aOne(finding.parent) + ' can read your ' + finding.table +
+      ' table, which holds ' + listOf(finding.secrets || []) + '.';
+  }
+  if (finding.kind === 'bucket' && finding.noRule && (finding.writers || []).length) {
+    return 'Your ' + finding.table + ' storage bucket is public, though only signed-in members may put files in it.';
+  }
+  if (finding.kind === 'bucket' && finding.noRule) {
+    return 'Your ' + finding.table + ' storage bucket is public, and its name says its files are not for everyone.';
+  }
+  if (finding.kind === 'bucket') {
+    return 'Your ' + finding.table + ' storage bucket is public, but a rule says only some people may read it.';
+  }
+  if (publicByDesign(finding)) {
+    return 'Anyone can read your ' + finding.table + ' table - is it public by design?';
+  }
+  if (finding.kind === 'exposed') {
+    return 'Your ' + finding.table + ' ' + (finding.isView ? 'view' : 'table') + ' can be read by anyone.';
+  }
+  // The table name goes in front of the sentence rather than inside it. Put
+  // inside, a table called `customers` produced "One customer can read another
+  // customer's customers", which is the kind of line that loses a reader.
+  if (finding.asRole) {
+    return capital(aRole(finding.asRole)) + ' of any ' + oneOf(finding.parent) + ' can read every other ' + oneOf(finding.parent) +
+      '\'s rows in your ' + finding.table + ' table.';
+  }
+  if (finding.tenant) return 'Your ' + finding.table + ' table lets a signed-in user read another organization\'s rows.';
+  return 'Your ' + finding.table + ' table lets one customer read another one\'s rows.';
+}
+
+/** What a duplicate of this particular column actually costs the person. */
+const COST_OF_A_DUPLICATE = {
+  credential: 'A credential that matches more than one row means one secret opens more than one account.',
+  identity: 'Two accounts can answer to the same login, and a password reset has to guess which one to send.',
+  code: 'A one-time code that can exist twice can be redeemed twice.',
+};
+
+// Said instead of the login sentence when sign-in happens in auth.users.
+const COST_OF_A_COPIED_IDENTITY =
+  'Signing in is not affected: your app signs people in through auth.users, ' +
+  'which keeps each email unique. But anything that looks a person up by this ' +
+  'column can get two rows back and pick the wrong one.';
+
+function costOf(finding) {
+  if (finding.expectation === 'identity' && finding.loginElsewhere) return COST_OF_A_COPIED_IDENTITY;
+  return COST_OF_A_DUPLICATE[finding.expectation] || '';
+}
+
+function bodyFor(finding, contents) {
+  const holds = listOf(heldIn(contents));
+  const rowWord = finding.readable === 1 ? 'row' : 'rows';
+
+  if (finding.kind === 'recursive') {
+    // Said as what happened to the requests, and then what it cost this
+    // report: the tables behind the error could not be tested for leaks.
+    const reads = finding.reads || [];
+    const callers = finding.callers || [];
+    const as = [];
+    if (callers.includes('anyone')) as.push('a visitor who is not logged in');
+    if (callers.includes('signed-in')) as.push('a signed-in user');
+    const one = reads.length === 1;
+    return (
+      'Using ' + listOf(reads) + ' on a copy of your app as ' + as.join(' and as ') +
+      ', every request was refused with ' + loopError(finding) +
+      (finding.deep ? ' - a rule on ' + finding.table + ' calls a helper that reads ' + finding.table + ' again, which runs the rule again' : '') +
+      '. Every page in your app that uses ' + (one ? 'that table' : 'those tables') +
+      ' fails the same way for ' + loopVictims(finding).replace(/,$/, '') + '. It also means I could ' +
+      'not test ' + (one ? 'it' : 'them') + ' for leaks - those attacks are listed at the end.'
+    );
+  }
+
+  if (finding.kind === 'orphaned') {
+    // Said as the thing a person will actually meet: a customer asks to be
+    // deleted, and their rows are still here afterwards.
+    return (
+      'I added a row to ' + finding.table + ' naming a ' +
+      finding.parent.replace(/s$/, '') + " that is not in your " + finding.parent +
+      ' table, and it was accepted. So when one of them is deleted, the rows here ' +
+      'stay behind pointing at nobody - and a signup or checkout that stops halfway ' +
+      'leaves the same thing. The row I added was undone straight away.'
+    );
+  }
+
+  if (finding.kind === 'writable') {
+    const holds = listOf(heldIn(contents));
+    const who = finding.who === 'anyone'
+      ? 'Without logging in and without an account, I '
+      : 'Signed in as one of your customers, I ';
+    const did = [];
+    if ((finding.can || []).includes('add')) did.push('added a row');
+    if ((finding.can || []).includes('change')) {
+      did.push('changed ' + (finding.changed.change || 1) + " of another customer's rows");
+    }
+    if ((finding.can || []).includes('delete')) {
+      did.push('deleted ' + (finding.changed.delete || 1) + " of another customer's rows");
+    }
+    // Said immediately, because "I deleted your rows" is a sentence that stops
+    // somebody reading, and they need the next line more than the first.
+    return who + listOf(did) + ' on a copy of your app' +
+      (finding.isView ? ', through the ' + finding.table + ' view - the same writes on the ' + finding.base +
+        ' table itself did not get as far' : '') +
+      (holds ? ', in a table holding ' + holds : '') +
+      '. Every one of those was undone straight away - nothing on the copy was ' +
+      'kept, and your live app was never touched.';
+  }
+
+  if (finding.kind === 'role' && finding.takeover) {
+    // Not a matter of taste like a viewer who may edit: taking somebody
+    // else's membership is never what a role is for.
+    const place = oneOf(finding.parent);
+    return (
+      'I put one of my fake people into the other one\'s ' + place + ' as ' + aRole(finding.who) +
+      ' in ' + finding.via + '.' + finding.roleColumn + ' and, signed in as them, changed ' +
+      finding.via + '.' + finding.personColumn + ' on the other person\'s own membership row to their own id - so ' +
+      'they held that member\'s place and role, on a copy of your app. Before joining, they could not. It was ' +
+      'undone straight away. A member taking over another member\'s row is never something a role should be able ' +
+      'to do, even where members may edit some of a membership.'
+    );
+  }
+
+  if (finding.kind === 'role' && finding.movein) {
+    // Never the design: nobody was invited, and the team they moved into is
+    // somebody else's.
+    const place = oneOf(finding.parent);
+    return (
+      'Signed in as one of my fake people - not a member of the other one\'s ' + place + ', never invited - I ' +
+      'changed their own row in ' + finding.via + ': ' + listOf((finding.moved || []).map((c) => finding.via + '.' + c)) +
+      ' to the other ' + place + ', and ' + finding.via + '.' + finding.roleColumn + ' to "' + finding.toRole +
+      '" - on a copy of your app. It went through, and was undone straight away. Anybody who can sign up and has a ' +
+      place + ' of their own can do this to every ' + place + ' whose id they learn, and from then on has every right ' +
+      aRole(finding.toRole) + ' has there.'
+    );
+  }
+  if (finding.kind === 'role' && finding.promote) {
+    // Never the design: a member who can raise their own role has every
+    // right the top role has, in every table that trusts the role.
+    const place = oneOf(finding.parent);
+    return (
+      'I put one of my fake people into the other one\'s ' + place + ' as ' + aRole(finding.who) +
+      ' in ' + finding.via + '.' + finding.roleColumn + ' and, signed in as them, changed ' + finding.via + '.' +
+      finding.roleColumn + ' on their own membership row to "' + finding.toRole + '" - on a copy of your app. It was ' +
+      'undone straight away. From then on they would have every right ' + aRole(finding.toRole) + ' has, in every ' +
+      'table and function that trusts that role.'
+    );
+  }
+
+  if (finding.kind === 'role') {
+    // Said as what was done, and then whose decision it is: a viewer who may
+    // edit is a hole in one app and the design of another.
+    const did = [];
+    const rows = (n) => n + (n === 1 ? ' row' : ' rows');
+    if ((finding.can || []).includes('add')) did.push('added ' + rows((finding.changed || {}).add || 1));
+    if ((finding.can || []).includes('change')) did.push('changed ' + rows((finding.changed || {}).change || 1));
+    if ((finding.can || []).includes('delete')) did.push('deleted ' + rows((finding.changed || {}).delete || 1));
+    const place = oneOf(finding.parent);
+    // The roles below it that were tried first and could not, when there are
+    // any: a role in the middle is named because the ones under it held.
+    const below = (finding.below || []).map((r) => '"' + r + '"');
+    return (
+      'I put one of my fake people into the other one\'s ' + place + ' as ' + aRole(finding.who) +
+      ' - ' + (below.length ? 'a role' : 'the lowest role') + ' in ' + finding.via + '.' + finding.roleColumn +
+      ' - and, signed in as them, I ' + listOf(did) + ' in ' + finding.table + ' for that ' + place +
+      ', on a copy of your app. Before joining, they could not.' +
+      (below.length ? ' As ' + listOf(below).replace(/ and /, ' or ') + ' they could not either, and no rule on this ' +
+        'table lists ' + aRole(finding.who).replace(/^an? /, '') + ' among the roles allowed to make that change.' : '') +
+      ' Every one of those was undone straight away. Whether ' + aRole(finding.who) + ' may do this is your ' +
+      'decision: if it is meant to, nothing needs fixing; if not, the rules on this table let them do more.'
+    );
+  }
+
+  if (finding.kind === 'teamread') {
+    // Said as what was read and by whom, and which roles below it could not:
+    // a dispatcher seeing a key may be the design, a viewer rarely is.
+    const place = oneOf(finding.parent);
+    const n = finding.readable || 1;
+    const below = (finding.below || []).map((r) => '"' + r + '"');
+    return (
+      'I put one of my fake people into the other one\'s ' + place + ' as ' + aRole(finding.who) + ' and, signed ' +
+      'in as them, read ' + n + (n === 1 ? ' row' : ' rows') + ' of ' + finding.table + ' for that ' + place +
+      ', on a copy of your app - including ' + listOf(finding.secrets || []) + '. Before joining, they could not.' +
+      (below.length ? ' As ' + listOf(below).replace(/ and /, ' or ') + ' they could not read it either.' : '') +
+      ' Nothing was changed. Whether ' + aRole(finding.who) + ' should see these is your decision: if not, a read ' +
+      'rule on this table lets them.'
+    );
+  }
+
+  if (finding.kind === 'bucket' && finding.noRule) {
+    return (
+      'In Supabase Storage the bucket "' + finding.bucket + '" is set to public, so anyone with a ' +
+      'file\'s link can download it without logging in - the rules on storage.objects are not asked. ' +
+      ((finding.writers || []).length
+        ? 'No rule says who may read it, but ' + listOf((finding.writers || []).map((r) => '"' + r + '"')) +
+          ' let only signed-in members put files in or take them out - so the app treats these files as its ' +
+          'members\' own, while anyone holding a link can download them. '
+        : 'No rule says who may read it, but its name says what it holds, and that does not sound like ' +
+          'something for everyone. ') +
+      'I only read the bucket\'s setting and its rules; I did not open or list ' +
+      'any file. Whether it should be public is yours to say.'
+    );
+  }
+  if (finding.kind === 'bucket') {
+    // Said as what was read, never as a file taken: no file was opened.
+    return (
+      'In Supabase Storage the bucket "' + finding.bucket + '" is set to public, so anyone with a ' +
+      'file\'s link can download it without logging in - the rules on storage.objects are not asked. ' +
+      'You also wrote ' + ((finding.rules || []).length === 1 ? 'a rule' : 'rules') + ' saying who may read it (' +
+      listOf(finding.rules || []) + '), so it was probably meant to be private. I only read the ' +
+      'bucket\'s setting and its rules; I did not open or list any file. Whether it should be public ' +
+      'is yours to say.'
+    );
+  }
+
+  if (finding.kind === 'searchpath') {
+    return (
+      'This function is SECURITY DEFINER, so it runs as whoever created it and the row level ' +
+      'security on the tables it touches is skipped for the caller - and ' +
+      (finding.anon ? 'anyone, even without an account,' : 'every signed-in user') + ' can call it. ' +
+      'It does not set its search_path, so every table or function inside it written without a ' +
+      'schema (scans rather than public.scans) is looked up wherever the caller\'s path points ' +
+      'first. Somebody able to put a table or function earlier on that path would make it use ' +
+      'theirs, with the owner\'s rights. I did not call it; this is read from how it is declared.'
+    );
+  }
+  if (finding.kind === 'conflict') {
+    return (
+      finding.fn + ' inserts into ' + finding.target + ' with ON CONFLICT (' + finding.on + '). ' +
+      'Postgres needs a unique index or constraint on exactly those columns to know what a ' +
+      'conflict is, and ' + finding.target + ' has none it can use, so it refuses the statement - ' +
+      'the function errors on every call instead of saving. ' +
+      (finding.partialWhere
+        ? 'There is a unique index on those columns, but it is partial (WHERE ' + finding.partialWhere +
+          '), and a partial index is only used when the ON CONFLICT repeats its WHERE. '
+        : '') +
+      'I did not call the function: I asked Postgres to plan that one statement on the copy, and ' +
+      'it answered "there is no unique or exclusion constraint matching the ON CONFLICT specification".'
+    );
+  }
+  if (finding.kind === 'nullcheck') {
+    return (
+      finding.column + ' has a CHECK that allows only ' +
+      listOf((finding.allowed || []).map((v) => '\'' + v + '\'')) + ' - but a CHECK only refuses a ' +
+      'value it can show is wrong, and an empty value (NULL) is never shown wrong, so it passes. ' +
+      'The column is not NOT NULL and has no default, so a row saved without a ' + finding.column +
+      ' is kept with none, and anything that shows or sorts by it has to cope. I did not insert ' +
+      'anything; this is read from how the column is declared.'
+    );
+  }
+  if (finding.kind === 'noinsert') {
+    return (
+      'Row level security is on for ' + finding.table + ', and the only ' + ((finding.rules || []).length === 1 ? 'rule' : 'rules') +
+      ' for adding rows (' + listOf((finding.rules || []).map((r) => '"' + r + '"')) + ') ' +
+      ((finding.rules || []).length === 1 ? 'has' : 'have') + ' neither USING nor WITH CHECK. A rule with no ' +
+      'expression is not "allow everything": Postgres treats it as false, so every INSERT - from the app, ' +
+      'and from any function that runs as the user - is refused with "new row violates row-level security ' +
+      'policy". If your app adds ' + finding.table + ' rows, that feature is broken for everyone. This is read ' +
+      'from how the rule is written; I did not insert anything.'
+    );
+  }
+  if (finding.kind === 'privileged') {
+    // Said as what is true, not as what was done - nothing was executed. The
+    // reach is real; whether it is a mistake is the person's to say, so the
+    // wording asks rather than accuses.
+    return (
+      'This function is SECURITY DEFINER, so it runs as whoever created it, not ' +
+      'as the visitor calling it - which means the row level security on the tables ' +
+      'it touches is checked against the owner and skipped for the caller. It is ' +
+      'granted to anon, the role a visitor with no account uses, so anyone on the ' +
+      'internet can call it' +
+      (finding.writes ? ' - and it writes to your data, so a caller can change rows the rules would otherwise protect.'
+                       : ', reaching whatever it reads past the rules on those tables.') +
+      ' I did not call it: whether an open function like this is intended is ' +
+      'something only you can confirm.' +
+      (finding.nullSlips
+        ? ' Its first lines do check the caller\'s role - but with NOT IN or <>, and somebody with no role ' +
+          'there gets NULL back, and NULL NOT IN (...) is not true: the IF never raises, so a signed-in ' +
+          'stranger gets through as if they had passed.'
+        : '') +
+      (finding.hasFixedSearchPath ? ''
+        : ' It also does not pin its search_path, so a caller can point the names ' +
+          'inside it at their own objects.')
+    );
+  }
+  if (finding.kind === 'duplicated') {
+    // Said as what was done, not as what it implies. Two connections, one
+    // moment, both accepted, and here is the count afterwards.
+    return (
+      'I opened two connections to a copy of your app and inserted the same ' +
+      finding.column + ' from both at the same moment. Both were accepted, so there are ' +
+      'now ' + finding.copies + ' rows holding the identical value. ' + costOf(finding)
+    ).trim();
+  }
+
+  if (publicByDesign(finding)) {
+    return (
+      'Without logging in and without an account, I read ' + finding.readable + ' ' +
+      (finding.readable === 1 ? 'row' : 'rows') + ' of this table on a copy of your app. Nothing in it says whose a ' +
+      'row is - no user, no team - and none of its columns look personal or secret, so it may be meant to be ' +
+      'public, like a price list or a blog. If it is, nothing needs to change.'
+    );
+  }
+  if (finding.kind === 'exposed') {
+    // Two different proofs, said as two different things. The copy-based scan
+    // signed in with the anon key and pulled the rows out; the outside check
+    // (outside.js) asked the live app for the count alone and never pulled a
+    // row, so it may not claim it did.
+    if (finding.countOnly) {
+      const many = finding.readable === 1 ? 'is 1 row' : 'are ' + finding.readable + ' rows';
+      return (
+        'Anyone on the internet, without logging in and without an account, can read ' +
+        'this table. I asked your live app as a stranger and it let me - there ' + many +
+        ' in it. I asked only for the count, so I never pulled a row out; a real ' +
+        'attacker would have taken them.'
+      );
+    }
+    return (
+      'Anyone on the internet, without logging in and without an account, can read ' +
+      // Read back the next morning, "just now" would be untrue: it was the
+      // nightly run, hours earlier.
+      'this table. ' + (finding.fromNight ? 'The nightly run did it on a copy and got back ' : 'I did it myself just now and got back ') +
+      finding.readable + ' ' + rowWord +
+      (holds ? ', including ' + holds : '') + '.'
+    );
+  }
+  if (finding.asRole) {
+    // Blind round 15: a role check in a read rule that was never tied to the
+    // row's own organization.
+    return (
+      'I made one of my fake people ' + aRole(finding.asRole) + ' of their own ' + oneOf(finding.parent) + ' (' + finding.via + '.' +
+      finding.roleColumn + ') and, signed in as them, asked for the other ' + oneOf(finding.parent) + '\'s rows in ' + finding.table +
+      ' and got ' + finding.readable + ' back' + (holds ? ', including ' + holds : '') + '. With an ordinary role they got none. ' +
+      'So anybody who is ' + aRole(finding.asRole) + ' anywhere - which in most apps means anybody who creates their own ' +
+      oneOf(finding.parent) + ' - can read every ' + oneOf(finding.parent) + '\'s rows here.'
+    );
+  }
+  if (finding.tenant) {
+    return (
+      'Signed in as someone in a different organization, I asked for another organization\'s rows and got ' +
+      finding.readable + ' of them back' + (holds ? ', including ' + holds : '') +
+      '. Anyone with an account can read every organization\'s rows.'
+    );
+  }
+  return (
+    'Signed in as one customer, I asked for another customer\'s rows and got ' +
+    finding.readable + ' of them back' + (holds ? ', including ' + holds : '') +
+    '. Every customer you have can do this to every other customer.'
+  );
+}
+
+/**
+ * The thing they paste.
+ *
+ * Written to the tool they already use, which means it has to carry its own
+ * context - the assistant on the other end has not seen any of this. It names
+ * the table, says what is wrong in terms of the code rather than the symptom,
+ * and asks for the same mistake to be swept up elsewhere, because it is almost
+ * never in only one place.
+ */
+/** Wraps one paragraph to a width that reads in a chat box and a terminal. */
+function wrapTo(text, width) {
+  const words = String(text).split(/\s+/);
+  const out = [];
+  let current = '';
+  for (const word of words) {
+    if ((current + ' ' + word).trim().length > width) {
+      out.push(current.trim());
+      current = word;
+    } else {
+      current = (current + ' ' + word).trim();
+    }
+  }
+  if (current) out.push(current.trim());
+  return out;
+}
+
+/**
+ * Whether the app signs people in through Supabase: any foreign key to
+ * auth.users, or any rule that asks auth.uid() or auth.jwt(). Decided for the
+ * whole app, not table by table. Found on a blind test: appointments points
+ * at profiles, which points at auth.users - no key of its own and no rule
+ * asking auth.uid(), so it was told the app "signs people in its own way"
+ * when it plainly used Supabase's. Read from the original schema, not the
+ * copy - the copy points those keys at a stand-in. A table missing from the
+ * map is unknown, which the prompts treat as tied.
+ */
+function authTiesOf(plan) {
+  const tables = (plan && plan.tables) || [];
+  const keyed = tables.some((table) => (table.constraints || []).some((c) =>
+    c.kind === 'f' && /references\s+"?auth"?\s*\.\s*"?users"?\s*\(/i.test(String(c.definition || ''))));
+  const asked = ((plan && plan.policies) || []).some((policy) =>
+    /\bauth\s*\.\s*(uid|jwt)\s*\(/i.test(String(policy.qual || '') + ' ' + String(policy.with_check || '')));
+  return new Map(tables.map((table) => [table.name, keyed || asked]));
+}
+
+/**
+ * The fix for a table no rule can tie to the signed-in user, or null when one
+ * can. Two ways that happens. The app has its own login: found on a real app,
+ * "compare the owner to the id of the signed-in user" cannot be done there -
+ * auth.uid() is empty for everybody - and an assistant that writes it anyway
+ * locks the app out of its own table. Or the table has no column saying whose
+ * row it is - a waitlist, a contact form - so there is nothing to compare.
+ */
+// A column that says which organization a row belongs to. Such a table is
+// not "nobody's" - its rows are a team's.
+const TENANT_COLUMN = /^(org_id|organization_id|workspace_id|team_id|tenant_id|company_id)$/i;
+
+function serverOnlyLines(finding) {
+  const table = finding.table;
+  let why;
+  // Found on a fix test: api_usage has org_id, and the prompt said it had no
+  // column saying whose row it is. The assistant applying it had to correct
+  // the prompt; a less careful one would have locked the table away from the
+  // members who use it.
+  // A row an organization owns names its organization even when the column is
+  // not called organization_id: the attack found which key it is.
+  const team = finding.authTied !== false &&
+    (finding.tenant ? finding.owner : (finding.columns || []).find((c) => TENANT_COLUMN.test(String(c))));
+  const maker = finding.owner || finding.ownedBy;
+  // A team's row that also says who made it - created_by beside workspace_id.
+  // Found on a benchmark: the prompt said to compare created_by to auth.uid()
+  // for reading, which hides every teammate's rows and breaks the shared
+  // view the table exists for. Who made a row decides who may write it
+  // under their name, not who may see it.
+  if (team && !finding.tenant && finding.owned !== false && maker) {
+    return [
+      'Rows in "' + table + '" belong to a team ("' + team + '"), and "' + maker + '" only records who ' +
+        'made each one. So reading should be decided by team membership: let a signed-in user read a ' +
+        'row when they are a member of that row\'s "' + team + '" - checked through your membership ' +
+        'table, or a helper function that asks it - and give logged-out visitors nothing. Do not ' +
+        'compare "' + maker + '" to auth.uid() for reading: that hides teammates\' rows from each other ' +
+        'and breaks the feature.',
+      '',
+      'Write separate rules for reading, inserting, updating and deleting. Inserting: WITH CHECK that ' +
+        'the user is a member of the row\'s "' + team + '" AND "' + maker + '" = auth.uid(), so nobody ' +
+        'writes a row under somebody else\'s name or into a team they are not in. Updating and ' +
+        'deleting: the membership check in USING (and WITH CHECK for updating), and decide whether any ' +
+        'member may do it or only the row\'s "' + maker + '" or an admin. If only your server writes ' +
+        'this table, add no write rules at all.',
+      '',
+    ];
+  }
+  const tenant = (finding.tenant || finding.owned === false) && team;
+  if (tenant) {
+    return [
+      'Rows in "' + table + '" belong to an organization ("' + tenant + '"), not to one person. So the ' +
+        'rule should let a signed-in user in only when they are a member of that row\'s organization - ' +
+        'checked through your membership table, or a helper function that asks it - and give logged-out ' +
+        'visitors nothing.',
+      '',
+      'Write separate rules for reading, inserting, updating and deleting, each with that membership ' +
+        'check (USING for reading, updating and deleting, WITH CHECK for inserting and updating), and ' +
+        'decide whether every member should be able to write or only admins. If only your server ' +
+        'writes this table, add no write rules at all.',
+      '',
+    ];
+  }
+  if (finding.authTied === false) {
+    why = 'Nothing in "' + table + '" points at auth.users and no rule on it uses auth.uid(), so your ' +
+      'app signs people in its own way. A rule comparing a column to the signed-in user cannot ' +
+      'work here - auth.uid() is empty for everyone - and adding one would lock your own app out.';
+  } else if (finding.owned === false) {
+    why = '"' + table + '" has no column that says whose row it is, so a rule tying rows to the ' +
+      'signed-in user has nothing to compare against.';
+  } else {
+    return null;
+  }
+  return [
+    why,
+    '',
+    'If only your server reads and writes this table: keep row level security on, drop the rules ' +
+      'that let everyone in, and add none for anon or authenticated. Have your server use the ' +
+      'service_role key, which skips these rules - and keep that key on the server only, never ' +
+      'in the browser or in the app\'s public code.',
+    '',
+    'If the browser needs to read or write part of it directly, tell me which part first, so we ' +
+      'write the narrowest rule for exactly that.',
+    '',
+  ];
+}
+
+/**
+ * The opening of a rules fix. "Switch row level security on" is said only
+ * when it is off: told it about a table where it was already on, the person
+ * looks for a switch that is already flipped and misses the rule that is the
+ * real problem.
+ */
+function switchOn(finding) {
+  return finding.rlsEnabled
+    ? 'Row level security is already on for this table, so the rules on it are the problem: '
+    : 'Switch row level security on for this table, then ';
+}
+
+/**
+ * One prompt for everything wrong with one table's rules - read and write,
+ * strangers and customers - because it is one rule to replace, not four.
+ */
+function groupPromptFor(members) {
+  const lead = members.find((m) => m.kind === 'writable') || members[0];
+  const cause = causeOf(lead);
+  const table = lead.table;
+  const owner = (members.find((m) => m.owner) || {}).owner;
+  const ownerWords = owner ? '"' + owner + '"' : 'the column that says who each row belongs to';
+  const read = members.find((m) => m.kind === 'exposed');
+  const writers = members.filter((m) => m.kind === 'writable');
+  const anyoneWrites = writers.find((w) => w.who === 'anyone');
+  const customersWrite = writers.find((w) => w.who !== 'anyone');
+  const what = [];
+  if (read) what.push('read');
+  if (writers.length) what.push('written');
+  const who = read || anyoneWrites ? 'anyone who is not logged in' : 'any signed-in user, including other users\' rows';
+  const did = [];
+  if (read) did.push('read ' + read.readable + ' ' + (read.readable === 1 ? 'row' : 'rows'));
+  const moves = [];
+  for (const w of writers) for (const m of w.can || []) if (!moves.includes(m)) moves.push(m);
+  for (const m of ['add', 'change', 'delete']) {
+    if (moves.includes(m)) did.push({ add: 'added a row', change: 'changed rows', delete: 'deleted rows' }[m]);
+  }
+  const lines = [
+    'My app has a security problem.',
+    '',
+    'The "' + table + '" table can be ' + what.join(' and ') + ' by ' + who +
+      ', because ' + cause.short + '. I proved it on a copy: I ' + listOf(did) + '.' +
+      (anyoneWrites && customersWrite ? ' Signed-in users can do the same.' : ''),
+    '',
+  ].concat(
+    serverOnlyLines(lead) || [
+        switchOn(lead) + 'remove the rule that lets everyone in, and write separate rules for reading, ' +
+          'inserting, updating and deleting. A rule written FOR ALL covers far more than reading.',
+        '',
+        'Each of them should compare ' + ownerWords + ' to the id of the signed-in user (auth.uid()): ' +
+          'USING for reading, updating and deleting, WITH CHECK for inserting and updating, so nobody ' +
+          'reads, changes or writes a row under somebody else\'s name. Give logged-out visitors no rule ' +
+          'at all unless they truly need one.',
+        '',
+      ],
+    ['Then check every other table for the same thing.'],
+  );
+  return lines
+    .map((paragraph) => (paragraph ? wrapTo(paragraph, 72) : ['']))
+    .reduce((all, part) => all.concat(part), [])
+    .join('\n');
+}
+
+function fixPromptFor(finding) {
+  const cause = causeOf(finding);
+  const owner = finding.owner ? '"' + finding.owner + '"' : 'the column that says who each row belongs to';
+
+  const lines = publicByDesign(finding)
+    ? [
+      'My app may have a security problem - please check it rather than assume it.',
+      '',
+      'The "' + finding.table + '" table can be read by anyone who is not logged in. Nothing in it says whose a ' +
+        'row is, and none of its columns look personal or secret, so it may be meant to be public.',
+      '',
+      'First tell me: should logged-out visitors be able to read "' + finding.table + '"? If yes, change nothing.',
+      '',
+      'If not: ' + (finding.rlsEnabled ? 'row level security is already on, so remove the rule that lets everyone read it' :
+        'switch row level security on for it') + ', and add a rule for reading that lets in only the people who should ' +
+        'see it - signed-in users (TO authenticated), or the members of whoever the rows are for. Change nothing else.',
+    ]
+    : finding.kind === 'recursive'
+    ? [
+      'My app has a broken database rule.',
+      '',
+      'A row level security policy on the "' + finding.table + '" table reads "' + finding.table +
+        '" itself' + (finding.deep ? ', through a helper function it calls,' : '') +
+        ' so Postgres stops every request that touches it with ' + loopError(finding) + '. I saw it when using ' +
+        listOf((finding.reads || []).map((t) => '"' + t + '"')) + '.',
+      '',
+      'Show me the policies on "' + finding.table + '" and on every table whose policy reads "' +
+        finding.table + '", and find the lookup that goes back into "' + finding.table + '".',
+      '',
+      'Move that lookup into a SECURITY DEFINER function that answers only about the signed-in ' +
+        'user - for example is_member_of(org uuid) returning whether auth.uid() is in that ' +
+        'organization - with SET search_path fixed, owned by the table\'s owner so it reads the ' +
+        'table without the rule applying again. Grant EXECUTE on it to authenticated only. Then ' +
+        'make the policies call that function instead of reading "' + finding.table + '" directly.',
+      '',
+      'Keep each policy exactly as strict as it was meant to be: members see only their own ' +
+        'organization\'s rows, and logged-out visitors get nothing. Do not replace it with USING ' +
+        '(true) to make the error go away.',
+      '',
+      'Then sign in as an ordinary user and open the pages that use these tables, and run this ' +
+        'check again - the tables it could not test will be tested this time.',
+    ]
+    : finding.kind === 'role' && finding.takeover
+    ? [
+      'My app has a permissions problem - a member can take over another member\'s place.',
+      '',
+      'In my database, a member of ' + aOne(finding.parent) + ' whose role in "' + finding.via + '"."' +
+        finding.roleColumn + '" is "' + finding.who + '" can update another member\'s row in "' + finding.via +
+        '" and set "' + finding.personColumn + '" to their own id - taking that member\'s place and role, an ' +
+        'admin\'s or the owner\'s included. This was proved on a copy of the database.',
+      '',
+      'Fix the rules on "' + finding.via + '" that cover UPDATE or ALL: nobody may change "' + finding.personColumn +
+        '" or the team a membership belongs to on an existing row - adding or removing members is how membership ' +
+        'changes. Let only the roles that manage the team (usually owner and admin) update membership rows at ' +
+        'all, check that in WITH CHECK as well as USING, and never use WITH CHECK (true). If members only need to ' +
+        'change something of their own, allow exactly that column on their own row and nothing else.',
+      '',
+      'Then check every function that updates "' + finding.via + '" for the same thing.',
+    ]
+    : finding.kind === 'role' && finding.movein
+    ? [
+      'My app has a security problem - anyone signed in can make themselves ' + aRole(finding.toRole) + ' of any ' +
+        oneOf(finding.parent) + '.',
+      '',
+      'In my database, a signed-in user can update their own row in "' + finding.via + '" and change ' +
+        listOf((finding.moved || []).map((c) => '"' + c + '"')) + ' to another ' + oneOf(finding.parent) +
+        ' - one they were never invited to - and "' + finding.roleColumn + '" to "' + finding.toRole + '". The rule only ' +
+        'checks that the row is theirs, not what they change in it. This was proved on a copy of the database.',
+      '',
+      'Fix the rules on "' + finding.via + '" that cover UPDATE or ALL: nobody may change ' +
+        listOf((finding.moved || []).map((c) => '"' + c + '"')) + ' on an existing row, and a member must never be ' +
+        'able to change "' + finding.roleColumn + '" on their own row. Joining happens only by an invitation that ' +
+        'somebody who manages that ' + oneOf(finding.parent) + ' made. Let only the roles that manage the team change ' +
+        'membership rows, checked in WITH CHECK as well as USING - for example with a helper that reads "' + finding.via +
+        '" for auth.uid() and the row\'s own ' + listOf((finding.moved || []).map((c) => '"' + c + '"')) + '.',
+      '',
+      'Then check every function that updates "' + finding.via + '" for the same thing.',
+    ]
+    : finding.kind === 'role' && finding.promote
+    ? [
+      'My app has a security problem - a member can make themselves ' + aRole(finding.toRole) + '.',
+      '',
+      'In my database, a member of ' + aOne(finding.parent) + ' whose role in "' + finding.via + '"."' +
+        finding.roleColumn + '" is "' + finding.who + '" can update their own row in "' + finding.via + '" and set "' +
+        finding.roleColumn + '" to "' + finding.toRole + '". The rule only checks that the row is theirs, not what ' +
+        'they change in it. This was proved on a copy of the database.',
+      '',
+      'Fix the rules on "' + finding.via + '" that cover UPDATE or ALL: a member must never be able to change "' +
+        finding.roleColumn + '" on their own row. Let only the roles that manage the team (usually owner and admin) ' +
+        'change roles, checked in WITH CHECK as well as USING - for example with a helper that reads "' + finding.via +
+        '" for auth.uid() - and make sure nobody can raise anyone above their own role. If members need to edit ' +
+        'something else of their own, allow exactly those columns and not "' + finding.roleColumn + '".',
+      '',
+      'Then check every function that updates "' + finding.via + '" for the same thing.',
+    ]
+    : finding.kind === 'role'
+    ? [
+      'My app may have a permissions problem - please check it rather than assume it.',
+      '',
+      'In my database, a member of ' + aOne(finding.parent) + ' whose role in "' + finding.via + '"."' +
+        finding.roleColumn + '" is "' + finding.who + '" can ' +
+        listOf((finding.can || []).map((what) => ({ add: 'add', change: 'change', delete: 'delete' })[what])) +
+        ' rows of that ' + oneOf(finding.parent) + ' in the "' + finding.table + '" table. This was proved ' +
+        'on a copy of the database: ' + aRole(finding.who) + ' was added, and the writes went through.',
+      '',
+      'First tell me: should ' + aRole(finding.who) + ' be able to do that? If yes, change nothing.',
+      '',
+      'If not, make the rules on "' + finding.table + '" that cover UPDATE, DELETE, INSERT or ALL check ' +
+        'the member\'s role as well as membership - for example with a helper that reads "' + finding.via +
+        '" for auth.uid() and the roles allowed to edit. Postgres lets a write through if ANY permissive ' +
+        'policy allows it, so a strict rule beside a loose one does nothing: list every such policy on "' +
+        finding.table + '" and narrow or drop the loose one. Keep the read rule as it is if ' +
+        aRole(finding.who) + ' should still see these rows.',
+      '',
+      'Then check every other table where members can write for the same thing.',
+    ]
+    : finding.kind === 'teamread'
+    ? [
+      'My app may have a permissions problem - please check it rather than assume it.',
+      '',
+      'In my database, a member of ' + aOne(finding.parent) + ' whose role in "' + finding.via + '"."' +
+        finding.roleColumn + '" is "' + finding.who + '" can read the "' + finding.table + '" table of that ' +
+        oneOf(finding.parent) + ', including ' + listOf((finding.secrets || []).map((c) => '"' + c + '"')) +
+        '. This was proved on a copy of the database: ' + aRole(finding.who) + ' was added, and the rows came back.',
+      '',
+      'First tell me: should ' + aRole(finding.who) + ' see these? If yes, change nothing.',
+      '',
+      'If not, make the rules on "' + finding.table + '" that cover SELECT or ALL check the member\'s role as ' +
+        'well as membership. Postgres lets a read through if ANY permissive policy allows it, so a strict rule ' +
+        'beside a loose one does nothing: list every such policy on "' + finding.table + '" and narrow or drop ' +
+        'the loose one. If members need the other columns, a view or function that leaves the secret ones out ' +
+        'is often the better fix.',
+      '',
+      'Then check every other table that holds tokens, keys, secrets or payloads for the same thing.',
+    ]
+    : finding.kind === 'bucket'
+    ? [
+      'My app may have a storage problem - please check it rather than assume it.',
+      '',
+      'The Supabase Storage bucket "' + finding.bucket + '" is public. Anyone with a file\'s URL can ' +
+        'download it without logging in' + (finding.noRule && (finding.writers || []).length
+        ? ', and no rule on storage.objects says who may read it - though ' +
+          listOf((finding.writers || []).map((r) => '"' + r + '"')) + ' let only signed-in members upload or delete ' +
+          'its files, which suggests they are not meant for everyone.'
+        : finding.noRule
+        ? ', and no rule on storage.objects says who may read it - its name suggests its files are not ' +
+          'meant for everyone.'
+        : ', and the storage.objects ' +
+          ((finding.rules || []).length === 1 ? 'policy that names' : 'policies that name') + ' this bucket (' +
+          listOf((finding.rules || []).map((r) => '"' + r + '"')) + ') ' +
+          ((finding.rules || []).length === 1 ? 'is' : 'are') + ' not checked for public URLs - so ' +
+          ((finding.rules || []).length === 1 ? 'it protects' : 'they protect') + ' nothing while it is public.'),
+      '',
+      'First tell me: is every file in this bucket meant to be downloadable by anyone? If yes, change nothing.',
+      '',
+      'If not, make the bucket private (in the Supabase dashboard: Storage, edit the bucket, turn Public ' +
+        'off - or UPDATE storage.buckets SET public = false WHERE id = \'' + finding.bucket + '\'). Then ' +
+        'change the app to fetch these files with signed URLs (createSignedUrl) instead of getPublicUrl, ' +
+        'or the links it shows will stop working.',
+      '',
+      finding.noRule
+        ? 'Once it is private, add a read rule on storage.objects for this bucket that lets in only the ' +
+          'people a file belongs to - without one, nobody but your server can read them.'
+        : 'Keep the read rule: once the bucket is private it is what decides who gets a file. Check that it ' +
+          'only lets in the right people.',
+      '',
+      'Then look at every other bucket for the same thing.',
+    ]
+    : finding.kind === 'searchpath'
+    ? [
+      'My app may have a security weakness - please check it rather than assume it.',
+      '',
+      'The database function "' + finding.fn + '(' + (finding.args || '') + ')" is SECURITY DEFINER ' +
+        '(it runs with its owner\'s rights) and does not set a search_path, so names inside it ' +
+        'without a schema are looked up along the caller\'s path.',
+      '',
+      'Fix only this: add SET search_path = \'\' to the function\'s definition, and write every ' +
+        'table, view and function it uses with its schema - public.scans, not scans; auth.uid() ' +
+        'stays as it is. Keep its body, its checks and its grants exactly as they are.',
+      '',
+      'Then call it once the way the app does, to make sure it still works, and look at every ' +
+        'other SECURITY DEFINER function for the same thing.',
+    ]
+    : finding.kind === 'conflict'
+    ? [
+      'My app has a broken database function.',
+      '',
+      'The function "' + finding.fn + '(' + (finding.args || '') + ')" runs INSERT INTO ' +
+        finding.target + ' ... ON CONFLICT (' + finding.on + '), and Postgres refuses it with ' +
+        '"there is no unique or exclusion constraint matching the ON CONFLICT specification" - so ' +
+        'it fails on every call.',
+      '',
+      finding.partialWhere
+        ? 'The unique index on (' + finding.on + ') is partial: WHERE ' + finding.partialWhere + '. ' +
+          'Repeat that condition in the function right after the conflict columns: ON CONFLICT (' +
+          finding.on + ') WHERE ' + finding.partialWhere + ' DO ... - and keep the rest of the ' +
+          'statement as it is. Do not drop the index\'s WHERE: it is what lets rows without a value exist.'
+        : 'Make the ON CONFLICT match a unique rule that exists: either add a unique constraint on ' +
+          finding.target + ' (' + finding.on + ') if those columns really must be unique together, or ' +
+          'change the conflict columns to an existing unique key. Tell me which you chose and why.',
+      '',
+      'Then call the function twice with the same values: the second call must update the row, ' +
+        'not error and not add a second one.',
+    ]
+    : finding.kind === 'nullcheck'
+    ? [
+      'My app may have a data problem - please check it rather than assume it.',
+      '',
+      'In the "' + finding.table + '" table, the column "' + finding.column + '" has a CHECK that ' +
+        'allows only ' + listOf((finding.allowed || []).map((v) => '\'' + v + '\'')) + ', but the column ' +
+        'can be empty (NULL), and a CHECK lets NULL through.',
+      '',
+      'First tell me: should every row have a ' + finding.column + '? If an empty one is meant to be ' +
+        'allowed, change nothing and say so.',
+      '',
+      'If every row should have one: set the empty ones first (UPDATE "' + finding.table + '" SET "' +
+        finding.column + '" = <the right value> WHERE "' + finding.column + '" IS NULL - ask me what ' +
+        'the right value is), then ALTER TABLE "' + finding.table + '" ALTER COLUMN "' + finding.column +
+        '" SET NOT NULL. Change nothing else.',
+    ]
+    : finding.kind === 'noinsert'
+    ? [
+      'My app may have a bug - please check it rather than assume it.',
+      '',
+      'In my database, the rule' + ((finding.rules || []).length === 1 ? ' ' : 's ') +
+        listOf((finding.rules || []).map((r) => '"' + r + '"')) + ' on "' + finding.table + '" for INSERT ' +
+        ((finding.rules || []).length === 1 ? 'has' : 'have') + ' no WITH CHECK, and there is no other rule that ' +
+        'allows adding rows. Postgres treats a missing check as false, so nobody can add a row to "' + finding.table +
+        '" - not even through a function that runs as the user.',
+      '',
+      'First tell me: is adding rows to "' + finding.table + '" meant to work for signed-in users? If only your ' +
+        'server adds them, change nothing.',
+      '',
+      'If users should be able to add them: give the rule a WITH CHECK that says who may - for example that ' +
+        'the user is a member of the row\'s organization (through your membership table or a helper) and that ' +
+        'the column naming who created it equals auth.uid(). Never use WITH CHECK (true): that lets anyone add ' +
+        'rows anywhere. Then add one row through the app to make sure it works.',
+    ]
+    : finding.kind === 'privileged'
+    ? [
+      'My app may have a security problem - please check it rather than assume it.',
+      '',
+      'The database function "' + finding.fn + '(' + (finding.args || '') + ')" is SECURITY ' +
+        'DEFINER, so it runs with its owner\'s rights and ignores row level security. It is ' +
+        'granted EXECUTE to "anon", so anyone who is not logged in can call it' +
+        (finding.writes ? ', and it writes to tables.' : '.'),
+      '',
+      'First tell me: is it meant to be callable by logged-out visitors? If it is not, ' +
+        'REVOKE EXECUTE ON FUNCTION ' + quotedFunction(finding.fn) + '(' + (finding.args || '') + ') FROM anon, PUBLIC.',
+      '',
+      // Found on a blind test (Northstar): get_recent_findings(org id) was
+      // the app's own RPC for signed-in members, and "grant it to
+      // service_role" would have broken the page that calls it.
+      'Then decide who should run it. If signed-in users of the app call it, keep it granted to ' +
+        'authenticated and add a check at its top that the caller - auth.uid() - may act on what ' +
+        'they passed in, for example that they are a member (or an admin) of the organization ' +
+        'whose id it takes, and RAISE an exception otherwise. Only if nothing but your own server ' +
+        'calls it, grant it to service_role alone.',
+      '',
+    ].concat(
+      finding.nullSlips
+        ? [
+          'Its role check lets through anyone with no role at all: the helper returns NULL for them, and ' +
+            'NULL NOT IN (...) - or NULL <> ... - is not true, so the IF never raises. Write the check so ' +
+            'NULL cannot pass, for example IF coalesce(<the helper>(...), \'none\') NOT IN (...) THEN RAISE, ' +
+            'or IF <the helper>(...) IS NULL OR <the helper>(...) NOT IN (...) THEN RAISE - and check every ' +
+            'other function that uses the same helper the same way.',
+          '',
+        ]
+        : [],
+      finding.hasFixedSearchPath
+        ? []
+        : [
+          'It also does not set a fixed search_path. Add SET search_path = pg_catalog, public (or ' +
+            'the schemas it truly needs) so a caller cannot make it resolve names to their own objects.',
+          '',
+        ],
+      [
+        'If it is meant to be public, keep it, but make sure everything inside it checks what the ' +
+          'caller is allowed to see or change itself - the table rules will not do it here.',
+        '',
+        'Then look at every other SECURITY DEFINER function for the same grant.',
+      ],
+    )
+    : finding.kind === 'orphaned'
+    ? [
+      'My app has a data problem.',
+      '',
+      'The "' + finding.table + '" table has a "' + finding.column +
+        '" column that is meant to point at "' + finding.parent + '".' +
+        ' There is no foreign key between them, so the database does not know they ' +
+        'are related. I proved it by adding a row naming one that does not exist, ' +
+        'and it was accepted.',
+      '',
+      'Add a foreign key from "' + finding.table + '"."' + finding.column +
+        '" to "' + finding.parent + '"."' + finding.parentKey + '".',
+      '',
+      'Decide on purpose what should happen when the parent row is deleted: ON ' +
+        'DELETE CASCADE if the children should go too, ON DELETE SET NULL if they ' +
+        'should stay without an owner, or nothing at all if the delete should be ' +
+        'refused while children exist.',
+      '',
+      'There may already be rows pointing at nothing, and the constraint will not ' +
+        'be created until those are dealt with. Find them first.',
+    ]
+    : finding.kind === 'writable' && finding.isView
+    ? [
+      'My app has a security problem.',
+      '',
+      'The "' + finding.table + '" view lets ' +
+        (finding.who === 'anyone' ? 'anyone who is not logged in' : 'any signed-in user') + ' write to the "' +
+        finding.base + '" table past its row level security: I ' +
+        (finding.can || []).map((what) => ({ add: 'added a row', change: 'changed rows', delete: 'deleted rows' })[what])
+          .join(', ') + ' through the view, and the same writes on the table itself did not get as far. A view runs with ' +
+        'the rights of whoever created it, so the rules on "' + finding.base + '" are never checked against the person asking.',
+      '',
+      'Fix it with ALTER VIEW "' + finding.table + '" SET (security_invoker = true), so reads and writes through the ' +
+        'view run as the person asking and the rules on "' + finding.base + '" apply. If the app only reads through it, ' +
+        'also REVOKE INSERT, UPDATE, DELETE ON "' + finding.table + '" FROM anon, authenticated. Change nothing else.',
+      '',
+      'Then check every other view in the app for the same thing.',
+    ]
+    : finding.kind === 'writable'
+    ? [
+      'My app has a security problem.',
+      '',
+      'The "' + finding.table + '" table can be written to by ' +
+        (finding.who === 'anyone' ? 'anyone who is not logged in' : 'any signed-in user, including other users rows') +
+        ', because ' + cause.short + '. I proved it: I ' +
+        (finding.can || []).map((what) => ({ add: 'added a row', change: 'changed rows', delete: 'deleted rows' })[what])
+          .join(', ') + '.',
+      '',
+    ].concat(
+      serverOnlyLines(finding) || [
+          switchOn(finding) + 'write separate rules for reading, inserting, updating and deleting. ' +
+            'A rule written FOR SELECT does not cover writes, and a rule written FOR ALL covers ' +
+            'far more than reading.',
+          '',
+          'For insert and update, use WITH CHECK comparing ' + owner +
+            ' to the id of the signed-in user, so nobody can write a row under somebody ' +
+            "else's name. For update and delete, add USING with the same comparison: " +
+            'with USING (true) left on the update, anyone can take a row that is not ' +
+            'theirs and rewrite it as their own.',
+          '',
+        ],
+      [
+        'Then check every other table for the same thing - a table with no row level ' +
+          'security on it is writable by default.',
+      ],
+    )
+    : finding.kind === 'duplicated'
+    ? [
+      'My app has a security problem.',
+      '',
+      'Two rows in the "' + finding.table + '" table can hold the same "' + finding.column +
+        '". I proved it by inserting the same value from two connections at the same ' +
+        'moment, and both were accepted.',
+      '',
+      // First, because it has to happen before anything is changed. Learned
+      // by applying the short version of this prompt literally to a real app:
+      // the constraint cannot be created while duplicates exist, and an
+      // assistant told only "add a constraint" may delete rows to get there.
+      'First, find the rows that already share a value and show them to me. Do not ' +
+        'delete or merge any of them without asking me: the rule below cannot be ' +
+        'created while they exist, and deleting rows to make it pass loses real data.',
+      '',
+      (finding.expectation === 'identity'
+        ? 'Then add a unique index on lower("' + finding.column + '"), so that "' + finding.table +
+          '"."' + finding.column + '" is unique whatever the case - Ann@example.com and ' +
+          'ann@example.com are the same person.'
+        : 'Then add a unique constraint on "' + finding.table + '"."' + finding.column + '".') +
+        ' It has to be in the database itself. Checking in application code before inserting ' +
+        'is not enough - between the check and the insert, the other request has already gone in.',
+      '',
+      // Said because the obvious fix is wrong for multi-tenant apps, and being
+      // told to drop a legitimate design would cost them more than the bug.
+      'If the same value is allowed to repeat for different owners, make it cover both ' +
+        'columns together rather than leaving it off.',
+      '',
+    ].concat(
+      [
+        'Find everything that writes this column - app code, and any database trigger or ' +
+          'function, such as one that copies each new sign-up into this table - and make ' +
+          'sure each one handles "this value already exists" instead of failing. If people ' +
+          'can edit this column themselves, decide whether they should: once it is unique, ' +
+          'someone who puts another person\'s value in first will block that person.',
+        '',
+      ],
+      finding.expectation === 'identity' && finding.loginElsewhere
+        ? [
+          'Sign-in uses auth.users, so this column is only a copy of the email there. ' +
+            'Consider not letting people edit it at all and keeping it in step with auth.users.',
+          '',
+        ]
+        : [],
+      [
+        'Afterwards, sign up a brand-new account and edit an existing profile to make sure ' +
+          'both still work, and run this check again.',
+        '',
+        'Then look for the same missing constraint on every other table and fix those too.',
+      ],
+    )
+    : finding.asRole
+      ? [
+        'My app has a security problem.',
+        '',
+        'In "' + finding.table + '", anyone who is "' + finding.asRole + '" in their own ' + oneOf(finding.parent) + ' can read the rows ' +
+          'of every ' + oneOf(finding.parent) + '. I proved it on a copy: as "' + finding.asRole + '" of one ' + oneOf(finding.parent) +
+          ', I read ' + finding.readable + ' row(s) of another.',
+        '',
+        'A rule on "' + finding.table + '" checks the caller\'s role without tying it to the row - for example ' +
+          'exists (select 1 from ' + finding.via + ' m where m.' + finding.roleColumn + ' = \'' + finding.asRole + '\') with no ' +
+          'condition that m is the signed-in user\'s membership of THIS row\'s ' + oneOf(finding.parent) + '. Fix every rule on "' +
+          finding.table + '": a role check must say m.user_id = auth.uid() AND m.<' + oneOf(finding.parent) + ' id> = the row\'s ' +
+          oneOf(finding.parent) + ' id - or call a helper that does. Keep membership as the way in; do not replace it with USING (true).',
+        '',
+        'Then check every other rule and helper that checks a role for the same missing link.',
+      ]
+      : finding.isView
+      ? [
+        'My app has a security problem.',
+        '',
+        'The "' + finding.table + '" view can be read by anyone who is not logged in. ' +
+          'A view runs with the rights of whoever created it, so the row level security ' +
+          'on the tables underneath is never checked against the person asking.',
+        '',
+        'Fix it by recreating the view with security_invoker set on, so it runs as the ' +
+          'visitor and the rules on the underlying tables apply - and make sure those ' +
+          'tables actually have those rules.',
+        '',
+        'Then check every other view in the app for the same thing.',
+      ]
+      : [
+        'My app has a security problem.',
+        '',
+        'The "' + finding.table + '" table ' +
+          (finding.kind === 'exposed'
+            ? 'can be read by anyone who is not logged in, because ' + cause.short + '.'
+            : finding.tenant
+              ? 'lets a signed-in user read rows belonging to a different organization, because ' + cause.short + '.'
+              : 'lets one signed-in user read rows belonging to a different user, because ' + cause.short + '.'),
+        '',
+      ].concat(
+        serverOnlyLines(finding) || [
+            'Fix it so a person can only read their own rows: compare ' + owner +
+              ' against the id of the signed-in user, and make sure logged-out visitors get nothing.',
+            '',
+          ],
+        ['Then look for the same mistake on every other table and fix those too.'],
+      );
+  // Wrapped here rather than by whoever prints it: this text is pasted into a
+  // chat box as often as it is read in a terminal, and an unwrapped paragraph
+  // is a wall in both.
+  return lines
+    .map((paragraph) => (paragraph ? wrapTo(paragraph, 72) : ['']))
+    .reduce((all, part) => all.concat(part), [])
+    .join('\n');
+}
+
+// Found and said, but never claimed as a break: the owner decides. Counted
+// apart in the report, never towards the exit code or a clean re-check.
+const TO_CHECK = ['privileged', 'role', 'teamread', 'bucket', 'searchpath', 'nullcheck', 'noinsert'];
+// Functions, said by their name rather than a table's.
+const ON_A_FUNCTION = ['privileged', 'searchpath', 'conflict'];
+
+/** Everything the report needs about one thing the attack found. */
+function describe(finding) {
+  const contents = readContents(finding.columns);
+  const cause = causeOf(finding);
+  return {
+    severity: severityOf(finding, contents),
+    // Every other finding here was proven by an attack that ran; this is the
+    // one the tool reasons about without executing, so it says so. The report
+    // and the re-check both read this: a "verification required" finding is
+    // never counted towards a clean re-check on its own.
+    status: (TO_CHECK.includes(finding.kind) && !(finding.kind === 'role' && finding.promote)) || publicByDesign(finding)
+      ? 'verification required' : 'confirmed',
+    table: ON_A_FUNCTION.includes(finding.kind) ? finding.fn : finding.table,
+    fn: finding.fn,
+    args: finding.args,
+    writes: finding.writes,
+    kind: finding.kind,
+    // Carried through because a table can have two different columns that each
+    // accept a duplicate, and the re-check tells one finding from another by
+    // what it is about. Without the column they would share an identity and
+    // fixing one would look like fixing both.
+    column: finding.column,
+    parent: finding.parent,
+    parentKey: finding.parentKey,
+    expectation: finding.expectation,
+    headline: headlineFor(finding, contents),
+    body: bodyFor(finding, contents),
+    // For a privileged function there is no "why the door is open" the way a
+    // table has one; the body already carries the whole explanation, so the
+    // cause line would only repeat it. Left empty and skipped by the report.
+    cause: TO_CHECK.includes(finding.kind) || finding.kind === 'conflict' || publicByDesign(finding) ? '' : cause.long,
+    who: finding.who,
+    can: finding.can,
+    // A view, and the table under it, so the re-check and the read-back say
+    // "view" and name the table the same way the report did (DB-09).
+    isView: finding.isView,
+    base: finding.base,
+    via: finding.via,
+    roleColumn: finding.roleColumn,
+    readable: finding.readable,
+    secrets: finding.secrets,
+    bucket: finding.bucket,
+    rules: finding.rules,
+    // An organization's rows read from outside it, and a member taking over
+    // another member's row: kept so the re-check and the read-back word them
+    // the same way the report did.
+    tenant: finding.tenant,
+    asRole: finding.asRole,
+    takeover: finding.takeover,
+    personColumn: finding.personColumn,
+    promote: finding.promote,
+    movein: finding.movein,
+    moved: finding.moved,
+    toRole: finding.toRole,
+    nullSlips: finding.nullSlips,
+    noRule: finding.noRule,
+    writers: finding.writers,
+    // Read from how a function or column is declared (scan.js searchPathsOf,
+    // conflictsIn, emptyChoicesOf); kept so the read-back says it the same way.
+    target: finding.target,
+    on: finding.on,
+    partialWhere: finding.partialWhere,
+    allowed: finding.allowed,
+    anon: finding.anon,
+    proof: finding.kind === 'searchpath'
+      ? 'I did not call "' + finding.fn + '". I read that it is SECURITY DEFINER with no search_path set.'
+      : finding.kind === 'conflict'
+      ? 'I asked Postgres to plan its INSERT INTO ' + finding.target + ' ... ON CONFLICT (' + finding.on +
+        ') on the copy, and it refused. I did not call the function.'
+      : finding.kind === 'nullcheck'
+      ? 'I read that "' + finding.table + '.' + finding.column + '" may be NULL and has no default. I did not insert anything.'
+      : finding.kind === 'noinsert'
+      ? 'I read that every rule for adding rows to "' + finding.table + '" (' + listOf((finding.rules || []).map((r) => '"' + r + '"')) +
+        ') has neither USING nor WITH CHECK. I did not insert anything.'
+      : finding.kind === 'recursive'
+      ? 'Using ' + listOf((finding.reads || []).map((t) => '"' + t + '"')) + ' stopped with ' +
+        loopError(finding) + '.'
+      : finding.kind === 'privileged'
+      ? 'I did not call "' + finding.fn + '". This is a reach that exists in the grants, not a break I ran.'
+      : finding.kind === 'role' && finding.takeover
+      ? 'As ' + aRole(finding.who) + ' who had just joined, I put my own id on the other person\'s row of "' +
+        finding.via + '", which I could not touch before joining. It was undone.'
+      : finding.kind === 'role' && finding.movein
+      ? 'Signed in, and not a member, I moved my own row of "' + finding.via + '" into the other ' + oneOf(finding.parent) +
+        ' with "' + finding.roleColumn + '" set to "' + finding.toRole + '". It was undone.'
+      : finding.kind === 'role' && finding.promote
+      ? 'As ' + aRole(finding.who) + ' who had just joined, I set "' + finding.roleColumn + '" on my own row of "' +
+        finding.via + '" to "' + finding.toRole + '". It was undone.'
+      : finding.kind === 'crossed' && finding.asRole
+      ? 'As "' + finding.asRole + '" of my own ' + oneOf(finding.parent) + ', I read ' + finding.readable + ' row(s) of "' +
+        finding.table + '" belonging to another; with an ordinary role, none. My role was put back.'
+      : finding.kind === 'role'
+      ? 'As ' + aRole(finding.who) + ' who had just joined, I ' +
+        listOf((finding.can || []).map((what) => {
+          const n = (finding.changed || {})[what] || 1;
+          return ({ add: 'added ', change: 'changed ', delete: 'deleted ' })[what] + n + (n === 1 ? ' row' : ' rows');
+        })) + ' in "' + finding.table + '" that I could not touch before joining. All of it was undone.'
+      : finding.kind === 'teamread'
+      ? 'As ' + aRole(finding.who) + ' who had just joined, I read ' + (finding.readable || 1) +
+        ((finding.readable || 1) === 1 ? ' row' : ' rows') + ' of "' + finding.table + '" that I could not read before joining.'
+      : finding.kind === 'bucket' && finding.noRule
+      ? 'I read that "' + finding.bucket + '" is public and that no rule says who may read it' +
+        ((finding.writers || []).length ? ', while ' + listOf((finding.writers || []).map((r) => '"' + r + '"')) +
+          ' limit uploads and deletes to signed-in members' : '') + '. I did not open any file.'
+      : finding.kind === 'bucket'
+      ? 'I read that "' + finding.bucket + '" is public and that ' + listOf((finding.rules || []).map((r) => '"' + r + '"')) +
+        ' says who may read it. I did not open any file.'
+      : finding.kind === 'duplicated'
+      ? 'I created ' + finding.copies + ' rows in "' + finding.table + '" holding the same ' +
+        finding.column + '.'
+      : finding.countOnly
+      ? 'I counted ' + finding.readable + ' ' + (finding.readable === 1 ? 'row' : 'rows') +
+        ' in "' + finding.table + '" that a stranger can read, without pulling any of them out.'
+      : 'I read ' + finding.readable + ' ' + (finding.readable === 1 ? 'row' : 'rows') +
+        ' from "' + finding.table + '" that should not have been readable.',
+    fixPrompt: fixPromptFor(finding),
+    contents: contents,
+  };
+}
+
+/** Everything wrong with one table's rules, said once. */
+function mergeTable(group, one) {
+  const members = group.map(one);
+  const read = group.find((m) => m.kind === 'exposed');
+  const anyoneWrites = group.find((m) => m.kind === 'writable' && m.who === 'anyone');
+  const customersWrite = group.find((m) => m.kind === 'writable' && m.who !== 'anyone');
+  const lead = anyoneWrites || customersWrite || read;
+  const leadItem = members[group.indexOf(lead)];
+  const table = lead.table;
+  const order = ['delete', 'change', 'add'];
+  const does = (w) => order.filter((m) => (w.can || []).includes(m)).map((m) => WRITE_WORDS[m]);
+  let headline;
+  if (read && anyoneWrites) {
+    const verbs = ['read'].concat(order.filter((m) => (anyoneWrites.can || []).includes(m)));
+    headline = 'Anyone can ' + listOf(verbs) + ' rows in your ' + table + ' table.';
+  } else if (read && customersWrite) {
+    headline = 'Anyone can read your ' + table + ' table, and any signed-in customer can ' + listOf(does(customersWrite)) + ' it.';
+  } else {
+    headline = leadItem.headline;
+  }
+  // The customers' part is said in one line when strangers can already do it.
+  const bodies = [];
+  for (let i = 0; i < group.length; i++) {
+    if (group[i] === customersWrite && anyoneWrites) continue;
+    bodies.push(members[i].body);
+  }
+  if (customersWrite && anyoneWrites) bodies.push('Signed-in customers can do the same.');
+  const severity = members.some((m) => m.severity === 'CRITICAL') ? 'CRITICAL' : leadItem.severity;
+  const can = [];
+  for (const m of group) for (const c of m.can || []) if (!can.includes(c)) can.push(c);
+  return Object.assign({}, leadItem, {
+    severity: severity,
+    status: 'confirmed',
+    kind: lead.kind,
+    who: read || anyoneWrites ? 'anyone' : leadItem.who,
+    can: can,
+    headline: headline,
+    body: bodies.join(' '),
+    proof: members.map((m) => m.proof).join(' '),
+    fixPrompt: groupPromptFor(group),
+    members: members,
+  });
+}
+
+/** The whole report, in the order a person should read it. */
+function describeAll(findings) {
+  // A table anyone can read is also, necessarily, a table one customer can read
+  // of another. Reporting both puts the same table on screen twice and turns
+  // two problems into a list of three that reads like a mistake. The public one
+  // is kept, and it carries the rest.
+  const raw = findings || [];
+  const publiclyOpen = new Set(raw.filter((f) => f.kind === 'exposed').map((f) => f.table));
+  // Writes through a view that strangers can already make are said once, by
+  // the strangers' finding, with the customers' part as one line.
+  const strangersThrough = (f) => raw.find((o) => o.kind === 'writable' && o.isView && o.who === 'anyone' && o.table === f.table &&
+    (f.can || []).every((c) => (o.can || []).includes(c)));
+  const kept = raw.filter((f) => !(f.kind === 'crossed' && publiclyOpen.has(f.table)) &&
+    !(f.kind === 'writable' && f.isView && f.who !== 'anyone' && strangersThrough(f)));
+  const one = (f) => {
+    const item = Object.assign(describe(f), {
+      alsoCrossed: f.kind === 'exposed' && raw.some((o) => o.kind === 'crossed' && o.table === f.table),
+    });
+    if (item.alsoCrossed) item.body += ' Your signed-in customers can read each other\'s rows for the same reason.';
+    if (f.kind === 'writable' && f.isView && f.who === 'anyone' &&
+        raw.some((o) => o.kind === 'writable' && o.isView && o.who !== 'anyone' && o.table === f.table)) {
+      item.body += ' Signed-in customers can do the same.';
+    }
+    return item;
+  };
+
+  // One table, one finding. A single rule written FOR ALL USING (true) opens a
+  // table to reading and writing, for strangers and customers alike - four
+  // proofs of one mistake. Listed as four, a real app's report showed six
+  // CRITICAL findings for two rules, and the person reads six problems where
+  // there are two to fix. The proofs are kept as members, so a re-check can
+  // still tell "strangers can no longer write" from "strangers can still read".
+  const grouped = new Map();
+  for (const f of kept) {
+    if ((f.kind !== 'exposed' && f.kind !== 'writable') || f.isView || f.countOnly) continue;
+    if (!grouped.has(f.table)) grouped.set(f.table, []);
+    grouped.get(f.table).push(f);
+  }
+  const described = [];
+  const done = new Set();
+  for (const f of kept) {
+    const group = grouped.get(f.table);
+    if (!group || group.length < 2 || group.indexOf(f) === -1) {
+      described.push(one(f));
+      continue;
+    }
+    if (done.has(f.table)) continue;
+    done.add(f.table);
+    described.push(mergeTable(group, one));
+  }
+  // Worst first, and within that the ones open to the whole internet before the
+  // ones that need an account, and those before the ones that need two requests
+  // to arrive together.
+  // Writes above reads: a table somebody emptied is worse than one they read.
+  // A looping rule sits with the reads: it breaks the app for everyone it
+  // fails for, which matters more than a duplicate or a stray row.
+  const byKind = { writable: 0, exposed: 1, crossed: 2, recursive: 2.5, conflict: 2.6, duplicated: 3, orphaned: 4, role: 4.5, teamread: 4.6, bucket: 4.7, privileged: 5, searchpath: 5.5, noinsert: 5.7, nullcheck: 6 };
+  const rank = (d) => (d.severity === 'CRITICAL' ? 0 : 1) * 10 + (byKind[d.kind] === undefined ? 9 : byKind[d.kind]);
+  return described.sort((a, b) => rank(a) - rank(b));
+}
+
+/** What is printed when a run finds nothing. Silence would read as a failure. */
+function allClearLines(attacksRun) {
+  // Nothing attacked is not the same as nothing got through. The callers all
+  // stop before this now, but the sentence is the one thing in the product
+  // that must never be printed by accident, so it guards itself too.
+  if (!attacksRun) {
+    return ['', '  I did not manage to attack anything, so there is nothing to report.', ''];
+  }
+  // "Your data held" used to be the last line here, and it was the wrong
+  // sentence: it says something about the app, and all this program knows is
+  // something about the attacks it happened to run. A person who reads "your
+  // data held" stops looking. A person who reads "these attacks lost" knows
+  // what they have been handed and what they have not.
+  return [
+    '',
+    '  Nothing got through.',
+    '',
+    '  I ran ' + attacksRun + ' ' + (attacksRun === 1 ? 'attack' : 'attacks') + ' against a copy of your app,',
+    '  and every one of them lost.',
+    '',
+    '  That is not the same as "your app is safe". It means these attacks,',
+    '  against this shape of database, this time, did not get in. Anything I',
+    '  did not try is listed at the end.',
+    '',
+  ];
+}
+
+module.exports = {
+  publicByDesign: publicByDesign,
+  authTiesOf: authTiesOf,
+  readContents: readContents,
+  severityOf: severityOf,
+  causeOf: causeOf,
+  describe: describe,
+  describeAll: describeAll,
+  fixPromptFor: fixPromptFor,
+  allClearLines: allClearLines,
+  listOf: listOf,
+};