{
 "id": "sample",
 "repo": "manra399/patchlabs-demo-app",
 "status": "done",
 "created_at": "2026-11-09T16:55:42.478572+00:00",
 "verified_at": "2026-11-09T16:56:15.619640+00:00",
 "finished_at": "2026-11-09T16:57:00.735345+00:00",
 "summary": {
  "models": [
   {
    "cost": 0.1146194,
    "model": "haiku",
    "passed": true,
    "seconds": 36
   }
  ],
  "break_risk": "low",
  "tables_leaking": [
   "profiles"
  ],
  "lab_proof_passed": true,
  "readable_by_anyone": [
   "profiles"
  ],
  "questions_for_owner": [],
  "readable_by_signed_in": []
 },
 "report_md": "# Leak check: manra399/patchlabs-demo-app\n\n_PatchLabs, 09 Nov 2026. Code-only check: no live system or customer data was accessed._\n\n## What we found\n- 1 table(s) holding personal data readable by the wrong people.\n- No exposed AI or API keys found (code and full git history).\n\n## Proof (our lab rebuilt your database from its migrations, seeded test rows, applied the fix)\n| Table | Who could read it | Verdict | Before | After | Result |\n|---|---|---|---|---|---|\n| `profiles` | anyone on the internet | bug | anon 2, stranger 2 | anon 0, stranger 0, owner 1 | closed |\n\n## The fix\nReplace 'Profiles are viewable by everyone' policy with owner-only SELECT, so users can only read their own profile\n\nRisk that something on the site behaves differently: **low**. Only breaks anonymous/other-user access which the frontend never relied on; users still read their own profiles as before\n\n---\nEvery change here was written and tested by PatchLabs agents. Nothing reaches your live app until your engineer merges this.\n_Run: 36s, models tried: haiku (passed)._",
 "fix_sql": "-- Fix: Replace overly permissive \"everyone can read\" policy with owner-only access\n-- The original policy \"Profiles are viewable by everyone\" allowed anonymous and any signed-in user\n-- to read all columns (email, phone) from all profile rows.\n-- Change: Only allow users to read their own profile (where user_id = auth.uid())\n\nDROP POLICY \"Profiles are viewable by everyone\" ON public.profiles;\nCREATE POLICY \"Users can view own profile\" ON public.profiles FOR SELECT USING (auth.uid() = user_id);\n",
 "events": []
}