kryptheon-night 0.1.8 → 0.1.10

package/attack.js

@@ -31,6 +31,39 @@ const USER_D = '66666666-6666-4666-8666-666666666666';
 // where the row id IS the person.
 const OWNER_NAMES = ['user_id', 'owner_id', 'owner', 'profile_id', 'account_id', 'created_by', 'author_id'];
 
+// A key to Supabase's auth.users as the app wrote it. In the copy it points
+// at a stand-in named kn_ext__auth__users, which the table-of-people rule
+// below already recognises; this one is for a table itself called users.
+const TO_AUTH_USERS = /REFERENCES\s+"?auth"?\s*\.\s*"?users"?\s*\(/i;
+// A table that looks like it holds people, keyed by the person.
+const PERSON_TABLE = /(profile|user|account|member)/i;
+
+/**
+ * The single-column keys from a uuid column, with what they point at. Read
+ * from the constraint wording itself, because a key to auth.users and a key
+ * to public.users are different things and the schema is part of the words.
+ */
+function personKeys(table, uuids) {
+  const byName = new Set(uuids.map((c) => c.name));
+  const keys = [];
+  for (const constraint of table.constraints || []) {
+    if (constraint.kind !== 'f') continue;
+    const definition = String(constraint.definition || '');
+    const match = /FOREIGN KEY \(([^)]+)\) REFERENCES ([^(]+)\(([^)]+)\)/i.exec(definition);
+    if (!match) continue;
+    const columns = match[1].split(',').map((t) => t.trim().split('"').join(''));
+    const refColumns = match[3].split(',').map((t) => t.trim().split('"').join(''));
+    if (columns.length !== 1 || !byName.has(columns[0])) continue;
+    keys.push({
+      column: columns[0],
+      toAuth: TO_AUTH_USERS.test(definition),
+      refTable: match[2].split('.').pop().trim().split('"').join(''),
+      refColumn: refColumns[0],
+    });
+  }
+  return keys;
+}
+
 /** The column that says who a row belongs to, or null if nothing does. */
 function ownerColumn(table) {
   const uuids = table.columns.filter((c) => c.type === 'uuid');
@@ -38,6 +71,19 @@ function ownerColumn(table) {
     const found = uuids.find((c) => c.name === name);
     if (found) return found.name;
   }
+  // Not named like an owner, but pointing at a person. Found on a blind test:
+  // appointments.provider_id -> profiles.id -> auth.users. Judged by name
+  // alone it had no owner, so "one provider reads another's patients" - a
+  // rule written USING (true) - was never tried, and the worst hole in the
+  // app went unreported. `id` first: a table keyed by the person is theirs.
+  // Two people on one row - sender_id and recipient_id - and neither is
+  // named: whose row it is cannot be told, and guessing would report one
+  // person reading a message sent to them as a break. So only one, or none.
+  const people = personKeys(table, uuids).filter((k) => k.toAuth ||
+    (k.refColumn === 'id' && k.refTable !== table.name && PERSON_TABLE.test(k.refTable)));
+  const columns = Array.from(new Set(people.map((k) => k.column)));
+  if (columns.includes('id')) return 'id';
+  if (columns.length === 1) return columns[0];
   // A profiles table keyed by the person themselves.
   if (/profile|user|account|member/i.test(table.name)) {
     const id = uuids.find((c) => c.name === 'id');

package/bin/kryptheon-night.js

@@ -561,12 +561,15 @@ async function main() {
     if (!before) {
       scanner.report(result);
       scanner.saveRun(file, result);
-      process.exitCode = result.stopped ? 2 : result.findings.length ? 1 : 0;
+      process.exitCode = scanner.exitCodeFor(result);
     } else {
       const verdict = recheck.compare(before, result);
       recheck.describe(verdict).forEach(line);
       recheck.badgeLines(verdict, result.attacksRun || 0).forEach(line);
+      // The report ends with what was not tested; with nothing left to report
+      // that list still has to be printed, or the re-check goes quiet about it.
       if (result.findings.length) scanner.report(result);
+      else scanner.notTestedLines(result).forEach(line);
       scanner.saveRun(file, result);
       process.exitCode = result.stopped ? 2 : verdict.allClear ? 0 : 1;
     }

package/engine.sql

@@ -1006,6 +1006,7 @@ RETURNS text LANGUAGE plpgsql IMMUTABLE AS $$
 DECLARE
   wanted text;
   found text;
+  people text[];
 BEGIN
   FOREACH wanted IN ARRAY ARRAY['user_id', 'owner_id', 'owner', 'profile_id',
                                 'account_id', 'created_by', 'author_id'] LOOP
@@ -1016,6 +1017,28 @@ BEGIN
     IF found IS NOT NULL THEN RETURN found; END IF;
   END LOOP;
 
+  -- Not named like an owner, but a single-column key from a uuid column to a
+  -- person: auth.users (or the copy's stand-in for it), or the id of a table
+  -- that holds people. Found on a blind test: appointments.provider_id ->
+  -- profiles.id was never tried. `id` first; two such columns (sender_id and
+  -- recipient_id) cannot say whose row it is, so they name no owner.
+  SELECT array_agg(DISTINCT k.col) INTO people
+    FROM (
+      SELECT __KN__.unquoted(p[1]) AS col,
+             (con->>'definition') ~* 'REFERENCES\s+"?auth"?\s*\.\s*"?users"?\s*\(' AS to_auth,
+             __KN__.unquoted(split_part(p[2], '.', greatest(array_length(string_to_array(p[2], '.'), 1), 1))) AS ref_table,
+             __KN__.unquoted(p[3]) AS ref_column
+        FROM jsonb_array_elements(coalesce(tab->'constraints', '[]'::jsonb)) con,
+             regexp_match(con->>'definition', 'FOREIGN KEY \(([^),]+)\) REFERENCES ([^(]+)\(([^),]+)\)', 'i') p
+       WHERE con->>'kind' = 'f' AND p IS NOT NULL
+    ) k
+   WHERE EXISTS (SELECT 1 FROM jsonb_array_elements(tab->'columns') c
+                  WHERE c->>'type' = 'uuid' AND c->>'name' = k.col)
+     AND (k.to_auth OR (k.ref_column = 'id' AND k.ref_table <> tab->>'name'
+                        AND k.ref_table ~* '(profile|user|account|member)'));
+  IF 'id' = ANY (coalesce(people, '{}')) THEN RETURN 'id'; END IF;
+  IF array_length(people, 1) = 1 THEN RETURN people[1]; END IF;
+
   -- A profiles table keyed by the person themselves.
   IF (tab->>'name') ~* '(profile|user|account|member)' THEN
     SELECT c->>'name' INTO found
@@ -1862,6 +1885,25 @@ END $$;
  * `seeded` carries the shape of row that worked when the table was seeded, so
  * the insert here is not rejected by some CHECK the seeder already solved.
  */
+/*
+ * Whose name an insert is written under: nobody's yet (user C), unless the
+ * owner column is a key into one of the app's own tables, where only the two
+ * seeded people exist - then the one who is not the signed-in caller.
+ */
+CREATE OR REPLACE FUNCTION __KN__.write_as_for(tab jsonb, owner text, tables jsonb)
+RETURNS text LANGUAGE plpgsql IMMUTABLE AS $$
+BEGIN
+  IF owner IS NOT NULL AND EXISTS (
+    SELECT 1 FROM jsonb_array_elements(__KN__.foreign_keys(tab)) k
+     WHERE jsonb_array_length(k->'columns') = 1 AND k->'columns'->>0 = owner
+       AND EXISTS (SELECT 1 FROM jsonb_array_elements(coalesce(tables, '[]'::jsonb)) t
+                    WHERE t->>'name' = k->>'refTable'))
+  THEN
+    RETURN __KN__.user_a();
+  END IF;
+  RETURN __KN__.user_c();
+END $$;
+
 CREATE OR REPLACE FUNCTION __KN__.tamper(source text, tables jsonb, seeded jsonb,
                                        policies jsonb DEFAULT '[]'::jsonb)
 RETURNS jsonb LANGUAGE plpgsql AS $$
@@ -1925,7 +1967,10 @@ BEGIN
     -- Written under a name nobody has used, which is both what makes the row
     -- land at all and what makes it the right test: adding a row of your own
     -- is the feature, adding one under somebody else's name is not.
-    row_ := __KN__.row_for(source, tab, __KN__.user_c(), '7', NULL, shape);
+    -- Unless the owner is a key into one of the app's own tables, where only
+    -- the two seeded people exist: then the one who is not the signed-in
+    -- caller. Found on a blind test, where the nameless insert hit the key.
+    row_ := __KN__.row_for(source, tab, __KN__.write_as_for(tab, owner, tables), '7', NULL, shape);
 
     -- Every statement written out before anybody changes role.
     moves := jsonb_build_array(

package/finding.js

@@ -72,6 +72,14 @@ function listOf(items) {
  * should be fixed - there is no such thing as a low finding here.
  */
 function severityOf(finding, contents) {
+  if (finding.kind === 'privileged') {
+    // Not proven, so never CRITICAL: this is a reach that exists, not a break
+    // that was demonstrated. A function anon can call that also writes is worth
+    // more attention than one that only reads, but both stay HIGH and both
+    // carry "verification required" - the person has to say whether the anon
+    // call was intended.
+    return 'HIGH';
+  }
   if (finding.kind === 'orphaned') {
     // Nothing is exposed and nothing is destroyed, so this is not the same
     // order of thing as a table anyone can empty. It stays serious because
@@ -90,7 +98,13 @@ function severityOf(finding, contents) {
     // the table. A second row holding the same session token is critical even
     // if the table has nothing personal in it at all.
     if (finding.expectation === 'credential') return 'CRITICAL';
-    if (finding.expectation === 'identity') return 'CRITICAL';
+    // Critical only while this column could be the login itself. When the
+    // database has Supabase's auth.users, sign-in goes through that table,
+    // which keeps every email unique - so a duplicate here is a copy that
+    // disagrees with itself, not two accounts sharing one login. Found on a
+    // real app: the report said "two accounts can answer to the same login"
+    // about a profiles table the login never read.
+    if (finding.expectation === 'identity') return finding.loginElsewhere ? 'HIGH' : 'CRITICAL';
     return 'HIGH';
   }
   if (contents.secrets.length) return 'CRITICAL';
@@ -247,6 +261,9 @@ function headlineFor(finding) {
   if (finding.kind === 'duplicated') {
     return 'Your ' + finding.table + ' table lets the same ' + finding.column + ' exist twice.';
   }
+  if (finding.kind === 'privileged') {
+    return 'Anyone on the internet can call your ' + finding.fn + ' function, and it runs with full rights.';
+  }
   if (finding.kind === 'exposed') {
     return 'Your ' + finding.table + ' ' + (finding.isView ? 'view' : 'table') + ' can be read by anyone.';
   }
@@ -263,6 +280,17 @@ const COST_OF_A_DUPLICATE = {
   code: 'A one-time code that can exist twice can be redeemed twice.',
 };
 
+// Said instead of the login sentence when sign-in happens in auth.users.
+const COST_OF_A_COPIED_IDENTITY =
+  'Signing in is not affected: your app signs people in through auth.users, ' +
+  'which keeps each email unique. But anything that looks a person up by this ' +
+  'column can get two rows back and pick the wrong one.';
+
+function costOf(finding) {
+  if (finding.expectation === 'identity' && finding.loginElsewhere) return COST_OF_A_COPIED_IDENTITY;
+  return COST_OF_A_DUPLICATE[finding.expectation] || '';
+}
+
 function bodyFor(finding, contents) {
   const holds = listOf(contents.secrets.concat(contents.identity, contents.money));
   const rowWord = finding.readable === 1 ? 'row' : 'rows';
@@ -300,14 +328,32 @@ function bodyFor(finding, contents) {
       'kept, and your live app was never touched.';
   }
 
+  if (finding.kind === 'privileged') {
+    // Said as what is true, not as what was done - nothing was executed. The
+    // reach is real; whether it is a mistake is the person's to say, so the
+    // wording asks rather than accuses.
+    return (
+      'This function is SECURITY DEFINER, so it runs as whoever created it, not ' +
+      'as the visitor calling it - which means the row level security on the tables ' +
+      'it touches is checked against the owner and skipped for the caller. It is ' +
+      'granted to anon, the role a visitor with no account uses, so anyone on the ' +
+      'internet can call it' +
+      (finding.writes ? ' - and it writes to your data, so a caller can change rows the rules would otherwise protect.'
+                       : ', reaching whatever it reads past the rules on those tables.') +
+      ' I did not call it: whether an open function like this is intended is ' +
+      'something only you can confirm.' +
+      (finding.hasFixedSearchPath ? ''
+        : ' It also does not pin its search_path, so a caller can point the names ' +
+          'inside it at their own objects.')
+    );
+  }
   if (finding.kind === 'duplicated') {
     // Said as what was done, not as what it implies. Two connections, one
     // moment, both accepted, and here is the count afterwards.
     return (
       'I opened two connections to a copy of your app and inserted the same ' +
       finding.column + ' from both at the same moment. Both were accepted, so there are ' +
-      'now ' + finding.copies + ' rows holding the identical value. ' +
-      (COST_OF_A_DUPLICATE[finding.expectation] || '')
+      'now ' + finding.copies + ' rows holding the identical value. ' + costOf(finding)
     ).trim();
   }
 
@@ -364,11 +410,146 @@ function wrapTo(text, width) {
   return out;
 }
 
+/**
+ * Whether the app signs people in through Supabase: any foreign key to
+ * auth.users, or any rule that asks auth.uid() or auth.jwt(). Decided for the
+ * whole app, not table by table. Found on a blind test: appointments points
+ * at profiles, which points at auth.users - no key of its own and no rule
+ * asking auth.uid(), so it was told the app "signs people in its own way"
+ * when it plainly used Supabase's. Read from the original schema, not the
+ * copy - the copy points those keys at a stand-in. A table missing from the
+ * map is unknown, which the prompts treat as tied.
+ */
+function authTiesOf(plan) {
+  const tables = (plan && plan.tables) || [];
+  const keyed = tables.some((table) => (table.constraints || []).some((c) =>
+    c.kind === 'f' && /references\s+"?auth"?\s*\.\s*"?users"?\s*\(/i.test(String(c.definition || ''))));
+  const asked = ((plan && plan.policies) || []).some((policy) =>
+    /\bauth\s*\.\s*(uid|jwt)\s*\(/i.test(String(policy.qual || '') + ' ' + String(policy.with_check || '')));
+  return new Map(tables.map((table) => [table.name, keyed || asked]));
+}
+
+/**
+ * The fix for a table no rule can tie to the signed-in user, or null when one
+ * can. Two ways that happens. The app has its own login: found on a real app,
+ * "compare the owner to the id of the signed-in user" cannot be done there -
+ * auth.uid() is empty for everybody - and an assistant that writes it anyway
+ * locks the app out of its own table. Or the table has no column saying whose
+ * row it is - a waitlist, a contact form - so there is nothing to compare.
+ */
+function serverOnlyLines(finding) {
+  const table = finding.table;
+  let why;
+  if (finding.authTied === false) {
+    why = 'Nothing in "' + table + '" points at auth.users and no rule on it uses auth.uid(), so your ' +
+      'app signs people in its own way. A rule comparing a column to the signed-in user cannot ' +
+      'work here - auth.uid() is empty for everyone - and adding one would lock your own app out.';
+  } else if (finding.owned === false) {
+    why = '"' + table + '" has no column that says whose row it is, so a rule tying rows to the ' +
+      'signed-in user has nothing to compare against.';
+  } else {
+    return null;
+  }
+  return [
+    why,
+    '',
+    'If only your server reads and writes this table: keep row level security on, drop the rules ' +
+      'that let everyone in, and add none for anon or authenticated. Have your server use the ' +
+      'service_role key, which skips these rules - and keep that key on the server only, never ' +
+      'in the browser or in the app\'s public code.',
+    '',
+    'If the browser needs to read or write part of it directly, tell me which part first, so we ' +
+      'write the narrowest rule for exactly that.',
+    '',
+  ];
+}
+
+/**
+ * One prompt for everything wrong with one table's rules - read and write,
+ * strangers and customers - because it is one rule to replace, not four.
+ */
+function groupPromptFor(members) {
+  const lead = members.find((m) => m.kind === 'writable') || members[0];
+  const cause = causeOf(lead);
+  const table = lead.table;
+  const owner = (members.find((m) => m.owner) || {}).owner;
+  const ownerWords = owner ? '"' + owner + '"' : 'the column that says who each row belongs to';
+  const read = members.find((m) => m.kind === 'exposed');
+  const writers = members.filter((m) => m.kind === 'writable');
+  const anyoneWrites = writers.find((w) => w.who === 'anyone');
+  const customersWrite = writers.find((w) => w.who !== 'anyone');
+  const what = [];
+  if (read) what.push('read');
+  if (writers.length) what.push('written');
+  const who = read || anyoneWrites ? 'anyone who is not logged in' : 'any signed-in user, including other users\' rows';
+  const did = [];
+  if (read) did.push('read ' + read.readable + ' ' + (read.readable === 1 ? 'row' : 'rows'));
+  const moves = [];
+  for (const w of writers) for (const m of w.can || []) if (!moves.includes(m)) moves.push(m);
+  for (const m of ['add', 'change', 'delete']) {
+    if (moves.includes(m)) did.push({ add: 'added a row', change: 'changed rows', delete: 'deleted rows' }[m]);
+  }
+  const lines = [
+    'My app has a security problem.',
+    '',
+    'The "' + table + '" table can be ' + what.join(' and ') + ' by ' + who +
+      ', because ' + cause.short + '. I proved it on a copy: I ' + listOf(did) + '.' +
+      (anyoneWrites && customersWrite ? ' Signed-in users can do the same.' : ''),
+    '',
+  ].concat(
+    serverOnlyLines(lead) || [
+        'Switch row level security on for this table, remove the rule that lets everyone in, and ' +
+          'write separate rules for reading, inserting, updating and deleting. A rule written FOR ALL ' +
+          'covers far more than reading.',
+        '',
+        'Each of them should compare ' + ownerWords + ' to the id of the signed-in user (auth.uid()): ' +
+          'USING for reading, updating and deleting, WITH CHECK for inserting and updating, so nobody ' +
+          'reads, changes or writes a row under somebody else\'s name. Give logged-out visitors no rule ' +
+          'at all unless they truly need one.',
+        '',
+      ],
+    ['Then check every other table for the same thing.'],
+  );
+  return lines
+    .map((paragraph) => (paragraph ? wrapTo(paragraph, 72) : ['']))
+    .reduce((all, part) => all.concat(part), [])
+    .join('\n');
+}
+
 function fixPromptFor(finding) {
   const cause = causeOf(finding);
   const owner = finding.owner ? '"' + finding.owner + '"' : 'the column that says who each row belongs to';
 
-  const lines = finding.kind === 'orphaned'
+  const lines = finding.kind === 'privileged'
+    ? [
+      'My app may have a security problem - please check it rather than assume it.',
+      '',
+      'The database function "' + finding.fn + '(' + (finding.args || '') + ')" is SECURITY ' +
+        'DEFINER, so it runs with its owner\'s rights and ignores row level security. It is ' +
+        'granted EXECUTE to "anon", so anyone who is not logged in can call it' +
+        (finding.writes ? ', and it writes to tables.' : '.'),
+      '',
+      'First tell me: is it meant to be callable by logged-out visitors? If it is not, ' +
+        'REVOKE EXECUTE ON FUNCTION "' + finding.fn + '"(' + (finding.args || '') + ') FROM anon, PUBLIC, ' +
+        'and GRANT EXECUTE only to the role that should run it - usually service_role, the ' +
+        'backend key, the way an admin-only function like this should be reached.',
+      '',
+    ].concat(
+      finding.hasFixedSearchPath
+        ? []
+        : [
+          'It also does not set a fixed search_path. Add SET search_path = pg_catalog, public (or ' +
+            'the schemas it truly needs) so a caller cannot make it resolve names to their own objects.',
+          '',
+        ],
+      [
+        'If it is meant to be public, keep it, but make sure everything inside it checks what the ' +
+          'caller is allowed to see or change itself - the table rules will not do it here.',
+        '',
+        'Then look at every other SECURITY DEFINER function for the same grant.',
+      ],
+    )
+    : finding.kind === 'orphaned'
     ? [
       'My app has a data problem.',
       '',
@@ -399,17 +580,24 @@ function fixPromptFor(finding) {
         (finding.can || []).map((what) => ({ add: 'added a row', change: 'changed rows', delete: 'deleted rows' })[what])
           .join(', ') + '.',
       '',
-      'Switch row level security on for this table, then write separate rules for ' +
-        'reading, inserting, updating and deleting. A rule written FOR SELECT does ' +
-        'not cover writes, and a rule written FOR ALL covers far more than reading.',
-      '',
-      'For insert and update, use WITH CHECK comparing ' + owner +
-        ' to the id of the signed-in user, so nobody can write a row under somebody ' +
-        "else's name.",
-      '',
-      'Then check every other table for the same thing - a table with no row level ' +
-        'security on it is writable by default.',
-    ]
+    ].concat(
+      serverOnlyLines(finding) || [
+          'Switch row level security on for this table, then write separate rules for ' +
+            'reading, inserting, updating and deleting. A rule written FOR SELECT does ' +
+            'not cover writes, and a rule written FOR ALL covers far more than reading.',
+          '',
+          'For insert and update, use WITH CHECK comparing ' + owner +
+            ' to the id of the signed-in user, so nobody can write a row under somebody ' +
+            "else's name. For update and delete, add USING with the same comparison: " +
+            'with USING (true) left on the update, anyone can take a row that is not ' +
+            'theirs and rewrite it as their own.',
+          '',
+        ],
+      [
+        'Then check every other table for the same thing - a table with no row level ' +
+          'security on it is writable by default.',
+      ],
+    )
     : finding.kind === 'duplicated'
     ? [
       'My app has a security problem.',
@@ -418,17 +606,50 @@ function fixPromptFor(finding) {
         '". I proved it by inserting the same value from two connections at the same ' +
         'moment, and both were accepted.',
       '',
-      'Add a unique constraint on "' + finding.table + '"."' + finding.column +
-        '" in the database itself. Checking in application code before inserting is not ' +
-        'enough - between the check and the insert, the other request has already gone in.',
+      // First, because it has to happen before anything is changed. Learned
+      // by applying the short version of this prompt literally to a real app:
+      // the constraint cannot be created while duplicates exist, and an
+      // assistant told only "add a constraint" may delete rows to get there.
+      'First, find the rows that already share a value and show them to me. Do not ' +
+        'delete or merge any of them without asking me: the rule below cannot be ' +
+        'created while they exist, and deleting rows to make it pass loses real data.',
+      '',
+      (finding.expectation === 'identity'
+        ? 'Then add a unique index on lower("' + finding.column + '"), so that "' + finding.table +
+          '"."' + finding.column + '" is unique whatever the case - Ann@example.com and ' +
+          'ann@example.com are the same person.'
+        : 'Then add a unique constraint on "' + finding.table + '"."' + finding.column + '".') +
+        ' It has to be in the database itself. Checking in application code before inserting ' +
+        'is not enough - between the check and the insert, the other request has already gone in.',
       '',
       // Said because the obvious fix is wrong for multi-tenant apps, and being
       // told to drop a legitimate design would cost them more than the bug.
-      'If the same value is allowed to repeat for different owners, make the constraint ' +
-        'cover both columns together rather than leaving it off.',
+      'If the same value is allowed to repeat for different owners, make it cover both ' +
+        'columns together rather than leaving it off.',
       '',
-      'Then look for the same missing constraint on every other table and fix those too.',
-    ]
+    ].concat(
+      [
+        'Find everything that writes this column - app code, and any database trigger or ' +
+          'function, such as one that copies each new sign-up into this table - and make ' +
+          'sure each one handles "this value already exists" instead of failing. If people ' +
+          'can edit this column themselves, decide whether they should: once it is unique, ' +
+          'someone who puts another person\'s value in first will block that person.',
+        '',
+      ],
+      finding.expectation === 'identity' && finding.loginElsewhere
+        ? [
+          'Sign-in uses auth.users, so this column is only a copy of the email there. ' +
+            'Consider not letting people edit it at all and keeping it in step with auth.users.',
+          '',
+        ]
+        : [],
+      [
+        'Afterwards, sign up a brand-new account and edit an existing profile to make sure ' +
+          'both still work, and run this check again.',
+        '',
+        'Then look for the same missing constraint on every other table and fix those too.',
+      ],
+    )
     : finding.isView
       ? [
         'My app has a security problem.',
@@ -451,11 +672,14 @@ function fixPromptFor(finding) {
             ? 'can be read by anyone who is not logged in, because ' + cause.short + '.'
             : 'lets one signed-in user read rows belonging to a different user, because ' + cause.short + '.'),
         '',
-        'Fix it so a person can only read their own rows: compare ' + owner +
-          ' against the id of the signed-in user, and make sure logged-out visitors get nothing.',
-        '',
-        'Then look for the same mistake on every other table and fix those too.',
-      ];
+      ].concat(
+        serverOnlyLines(finding) || [
+            'Fix it so a person can only read their own rows: compare ' + owner +
+              ' against the id of the signed-in user, and make sure logged-out visitors get nothing.',
+            '',
+          ],
+        ['Then look for the same mistake on every other table and fix those too.'],
+      );
   // Wrapped here rather than by whoever prints it: this text is pasted into a
   // chat box as often as it is read in a terminal, and an unwrapped paragraph
   // is a wall in both.
@@ -471,7 +695,15 @@ function describe(finding) {
   const cause = causeOf(finding);
   return {
     severity: severityOf(finding, contents),
-    table: finding.table,
+    // Every other finding here was proven by an attack that ran; this is the
+    // one the tool reasons about without executing, so it says so. The report
+    // and the re-check both read this: a "verification required" finding is
+    // never counted towards a clean re-check on its own.
+    status: finding.kind === 'privileged' ? 'verification required' : 'confirmed',
+    table: finding.kind === 'privileged' ? finding.fn : finding.table,
+    fn: finding.fn,
+    args: finding.args,
+    writes: finding.writes,
     kind: finding.kind,
     // Carried through because a table can have two different columns that each
     // accept a duplicate, and the re-check tells one finding from another by
@@ -483,10 +715,15 @@ function describe(finding) {
     expectation: finding.expectation,
     headline: headlineFor(finding, contents),
     body: bodyFor(finding, contents),
-    cause: cause.long,
+    // For a privileged function there is no "why the door is open" the way a
+    // table has one; the body already carries the whole explanation, so the
+    // cause line would only repeat it. Left empty and skipped by the report.
+    cause: finding.kind === 'privileged' ? '' : cause.long,
     who: finding.who,
     can: finding.can,
-    proof: finding.kind === 'duplicated'
+    proof: finding.kind === 'privileged'
+      ? 'I did not call "' + finding.fn + '". This is a reach that exists in the grants, not a break I ran.'
+      : finding.kind === 'duplicated'
       ? 'I created ' + finding.copies + ' rows in "' + finding.table + '" holding the same ' +
         finding.column + '.'
       : finding.countOnly
@@ -499,6 +736,50 @@ function describe(finding) {
   };
 }
 
+/** Everything wrong with one table's rules, said once. */
+function mergeTable(group, one) {
+  const members = group.map(one);
+  const read = group.find((m) => m.kind === 'exposed');
+  const anyoneWrites = group.find((m) => m.kind === 'writable' && m.who === 'anyone');
+  const customersWrite = group.find((m) => m.kind === 'writable' && m.who !== 'anyone');
+  const lead = anyoneWrites || customersWrite || read;
+  const leadItem = members[group.indexOf(lead)];
+  const table = lead.table;
+  const order = ['delete', 'change', 'add'];
+  const does = (w) => order.filter((m) => (w.can || []).includes(m)).map((m) => WRITE_WORDS[m]);
+  let headline;
+  if (read && anyoneWrites) {
+    const verbs = ['read'].concat(order.filter((m) => (anyoneWrites.can || []).includes(m)));
+    headline = 'Anyone can ' + listOf(verbs) + ' rows in your ' + table + ' table.';
+  } else if (read && customersWrite) {
+    headline = 'Anyone can read your ' + table + ' table, and any signed-in customer can ' + listOf(does(customersWrite)) + ' it.';
+  } else {
+    headline = leadItem.headline;
+  }
+  // The customers' part is said in one line when strangers can already do it.
+  const bodies = [];
+  for (let i = 0; i < group.length; i++) {
+    if (group[i] === customersWrite && anyoneWrites) continue;
+    bodies.push(members[i].body);
+  }
+  if (customersWrite && anyoneWrites) bodies.push('Signed-in customers can do the same.');
+  const severity = members.some((m) => m.severity === 'CRITICAL') ? 'CRITICAL' : leadItem.severity;
+  const can = [];
+  for (const m of group) for (const c of m.can || []) if (!can.includes(c)) can.push(c);
+  return Object.assign({}, leadItem, {
+    severity: severity,
+    status: 'confirmed',
+    kind: lead.kind,
+    who: read || anyoneWrites ? 'anyone' : leadItem.who,
+    can: can,
+    headline: headline,
+    body: bodies.join(' '),
+    proof: members.map((m) => m.proof).join(' '),
+    fixPrompt: groupPromptFor(group),
+    members: members,
+  });
+}
+
 /** The whole report, in the order a person should read it. */
 function describeAll(findings) {
   // A table anyone can read is also, necessarily, a table one customer can read
@@ -507,24 +788,44 @@ function describeAll(findings) {
   // is kept, and it carries the rest.
   const raw = findings || [];
   const publiclyOpen = new Set(raw.filter((f) => f.kind === 'exposed').map((f) => f.table));
-  const described = raw
-    .filter((f) => !(f.kind === 'crossed' && publiclyOpen.has(f.table)))
-    .map((f) =>
-      Object.assign(describe(f), {
-        alsoCrossed:
-          f.kind === 'exposed' && raw.some((o) => o.kind === 'crossed' && o.table === f.table),
-      }),
-    );
-  for (const item of described) {
-    if (item.alsoCrossed) {
-      item.body += ' Your signed-in customers can read each other\'s rows for the same reason.';
+  const kept = raw.filter((f) => !(f.kind === 'crossed' && publiclyOpen.has(f.table)));
+  const one = (f) => {
+    const item = Object.assign(describe(f), {
+      alsoCrossed: f.kind === 'exposed' && raw.some((o) => o.kind === 'crossed' && o.table === f.table),
+    });
+    if (item.alsoCrossed) item.body += ' Your signed-in customers can read each other\'s rows for the same reason.';
+    return item;
+  };
+
+  // One table, one finding. A single rule written FOR ALL USING (true) opens a
+  // table to reading and writing, for strangers and customers alike - four
+  // proofs of one mistake. Listed as four, a real app's report showed six
+  // CRITICAL findings for two rules, and the person reads six problems where
+  // there are two to fix. The proofs are kept as members, so a re-check can
+  // still tell "strangers can no longer write" from "strangers can still read".
+  const grouped = new Map();
+  for (const f of kept) {
+    if ((f.kind !== 'exposed' && f.kind !== 'writable') || f.isView || f.countOnly) continue;
+    if (!grouped.has(f.table)) grouped.set(f.table, []);
+    grouped.get(f.table).push(f);
+  }
+  const described = [];
+  const done = new Set();
+  for (const f of kept) {
+    const group = grouped.get(f.table);
+    if (!group || group.length < 2 || group.indexOf(f) === -1) {
+      described.push(one(f));
+      continue;
     }
+    if (done.has(f.table)) continue;
+    done.add(f.table);
+    described.push(mergeTable(group, one));
   }
   // Worst first, and within that the ones open to the whole internet before the
   // ones that need an account, and those before the ones that need two requests
   // to arrive together.
   // Writes above reads: a table somebody emptied is worse than one they read.
-  const byKind = { writable: 0, exposed: 1, crossed: 2, duplicated: 3, orphaned: 4 };
+  const byKind = { writable: 0, exposed: 1, crossed: 2, duplicated: 3, orphaned: 4, privileged: 5 };
   const rank = (d) => (d.severity === 'CRITICAL' ? 0 : 1) * 10 + (byKind[d.kind] === undefined ? 9 : byKind[d.kind]);
   return described.sort((a, b) => rank(a) - rank(b));
 }
@@ -557,6 +858,7 @@ function allClearLines(attacksRun) {
 }
 
 module.exports = {
+  authTiesOf: authTiesOf,
   readContents: readContents,
   severityOf: severityOf,
   causeOf: causeOf,