[
  {
    "verdict": "confirmed",
    "fingerprint": "yof/attack.tenant_read/sample-attack.tenant_read",
    "title": "One user can read another user's records by changing the id",
    "description": "A test account opened a record of your other test account just by using its id, so real users can read each other's data.",
    "root_cause": "A test account opened a record of your other test account just by using its id, so real users can read each other's data.",
    "intended_behavior": "An account can open only its own records; another account's id answers 404 or 403.",
    "trace": [
      {
        "kind": "sink",
        "file": "https://shop.example/api/orders/{id}",
        "line": 1,
        "scope": "live address (attack.tenant_read)",
        "description": "A test account opened a record of your other test account just by using its id, so real users can read each other's data."
      }
    ],
    "evidence": [
      {
        "file": "https://shop.example/api/orders/{id}",
        "line": 1,
        "description": "What yof saw (masked): 200 with another customer's order"
      }
    ],
    "conditions": [],
    "execution": {
      "attacker_perspective": "A test account or a visitor without a session, as the steps say.",
      "payloads": [
        "200 with another customer's order"
      ],
      "instructions": [
        "Sign in as test user b.",
        "Send GET /api/orders/{id} with an id that belongs to another user or role.",
        "What yof saw (masked): 200 with another customer's order",
        "Expected instead: An account can open only its own records; another account's id answers 404 or 403."
      ],
      "observed_result": "What yof saw (masked): 200 with another customer's order"
    },
    "remediation": {
      "strategy": "In my app, user B can read a record that belongs to user A by putting A's record id in the address (or sees it in a list). On the server, every query for a record or a list must be filtered by the signed-in user (or their workspace), for example `where id = :id and owner_id = :currentUser`, and answer 404 when the record is not theirs. If the database supports row-level security, turn it on with a policy that only allows the owner. Do not rely on ids being hard to guess."
    },
    "severity": {
      "likelihood": {
        "score": "high",
        "reason": "yof saw it on the live app."
      },
      "impact": {
        "score": "high",
        "reason": "People could see or change data that belongs to someone else."
      },
      "overall_severity": "high"
    },
    "confidence": {
      "score": "high",
      "reason": "yof saw it on the live app."
    }
  },
  {
    "verdict": "confirmed",
    "fingerprint": "yof/db.supabase_table_open/sample-db.supabase_table_open",
    "title": "Anyone can read a table in your database",
    "description": "A stranger can download the rows in this table, such as your customers' names, emails or orders, without signing in.",
    "root_cause": "A stranger can download the rows in this table, such as your customers' names, emails or orders, without signing in.",
    "intended_behavior": "Visitors who are not signed in cannot read this table.",
    "trace": [
      {
        "kind": "sink",
        "file": "https://shop.example/",
        "line": 1,
        "scope": "live address (db.supabase_table_open)",
        "description": "A stranger can download the rows in this table, such as your customers' names, emails or orders, without signing in."
      }
    ],
    "evidence": [
      {
        "file": "https://shop.example/",
        "line": 1,
        "description": "What yof saw (masked): table orders: 3 rows readable without signing in"
      }
    ],
    "conditions": [],
    "execution": {
      "attacker_perspective": "Anyone who can reach the live app.",
      "payloads": [
        "table orders: 3 rows readable without signing in"
      ],
      "instructions": [
        "Open https://shop.example/ without signing in.",
        "What yof saw (masked): table orders: 3 rows readable without signing in",
        "Expected instead: Visitors who are not signed in cannot read this table."
      ],
      "observed_result": "What yof saw (masked): table orders: 3 rows readable without signing in"
    },
    "remediation": {
      "strategy": "A Supabase table can be read by anyone with the public anon key. Turn on Row Level Security for this table (and every other table), then add policies so a signed-in person can only read their own rows (for example using auth.uid() = user_id). Remove any policy that allows the anon role to select everything. Write the SQL for me and explain what each policy allows. Never paste real customer data or keys into this chat.",
      "code_changes": [
        {
          "file_name": "configuration",
          "fixed_code": "-- for each table the browser can reach\nalter table public.your_table enable row level security;\ncreate policy \"own rows\" on public.your_table\n  for select using (auth.uid() = user_id);"
        }
      ]
    },
    "severity": {
      "likelihood": {
        "score": "high",
        "reason": "yof saw it on the live app."
      },
      "impact": {
        "score": "high",
        "reason": "People could see or change data that belongs to someone else."
      },
      "overall_severity": "high"
    },
    "confidence": {
      "score": "high",
      "reason": "yof saw it on the live app."
    }
  },
  {
    "verdict": "needs_validation",
    "fingerprint": "yof/email.dmarc_missing/sample-email.dmarc_missing",
    "title": "Your domain has no rule for fake email",
    "description": "Mail providers don't know what to do with messages that pretend to be you, so many of them get delivered.",
    "claimed_root_cause": "Mail providers don't know what to do with messages that pretend to be you, so many of them get delivered.",
    "trace": [
      {
        "kind": "sink",
        "file": "https://shop.example/",
        "line": 1,
        "scope": "live address (email.dmarc_missing)",
        "description": "Mail providers don't know what to do with messages that pretend to be you, so many of them get delivered."
      }
    ],
    "evidence": [
      {
        "file": "https://shop.example/",
        "line": 1,
        "description": "yof found it at https://shop.example/."
      }
    ],
    "blockers": [
      "The check did not keep the evidence needed to confirm it."
    ],
    "validation_plan": {
      "local": "Look up the domain's DNS TXT records (for example: dig TXT shop.example). Expected instead: The domain publishes a DMARC policy of quarantine or reject. Expected instead: The domain publishes a DMARC policy of quarantine or reject."
    }
  },
  {
    "verdict": "confirmed",
    "fingerprint": "yof/inside.dep_vulnerable_now/sample-inside.dep_vulnerable_now",
    "title": "minimist 1.2.5 has a known serious vulnerability (package-lock.json)",
    "description": "The weakness is public, with a published fix. Attackers scan for apps that still run the old version.",
    "root_cause": "The weakness is public, with a published fix. Attackers scan for apps that still run the old version.",
    "intended_behavior": "The installed version of minimist is at or above 1.2.6.",
    "trace": [
      {
        "kind": "sink",
        "file": "package-lock.json",
        "line": 812,
        "scope": "inside.dep_vulnerable_now",
        "description": "The weakness is public, with a published fix. Attackers scan for apps that still run the old version."
      }
    ],
    "evidence": [
      {
        "file": "package-lock.json",
        "line": 812,
        "description": "yof found it at package-lock.json:812 (example-shop/storefront at 0f1e2d3c4b5a)."
      }
    ],
    "conditions": [],
    "execution": {
      "attacker_perspective": "Anyone who can read the repository or what it ships.",
      "payloads": [
        "package-lock.json:812 (example-shop/storefront at 0f1e2d3c4b5a)"
      ],
      "instructions": [
        "Open package-lock.json:812 (example-shop/storefront at 0f1e2d3c4b5a).",
        "Expected instead: The installed version of minimist is at or above 1.2.6."
      ],
      "observed_result": "yof found it at package-lock.json:812 (example-shop/storefront at 0f1e2d3c4b5a)."
    },
    "remediation": {
      "strategy": "Upgrade minimist from 1.2.5 to 1.2.6 or newer (advisories: GHSA-xvch-5gv4-984h, CVE-2021-44906). Update package-lock.json with your package manager rather than by hand, run the install and the tests, and check whether the upgrade needs code changes."
    },
    "severity": {
      "likelihood": {
        "score": "high",
        "reason": "The repository holds the exact evidence."
      },
      "impact": {
        "score": "high",
        "reason": "A published weakness in a component could be used against the app."
      },
      "overall_severity": "high"
    },
    "confidence": {
      "score": "high",
      "reason": "The repository holds the exact evidence. yof did not see it on the live app, so it is rated high at most."
    }
  },
  {
    "verdict": "confirmed",
    "fingerprint": "yof/secret.stripe_live/sample-secret.stripe_live",
    "title": "Your Stripe secret key is in your page code (/assets/app.js)",
    "description": "Anyone can use it to take payments, give refunds and read your customers' payment details.",
    "root_cause": "Anyone can use it to take payments, give refunds and read your customers' payment details.",
    "intended_behavior": "No live Stripe secret key appears in code that visitors can download.",
    "trace": [
      {
        "kind": "sink",
        "file": "https://shop.example/assets/app.js",
        "line": 1,
        "scope": "live address (secret.stripe_live)",
        "description": "Anyone can use it to take payments, give refunds and read your customers' payment details."
      }
    ],
    "evidence": [
      {
        "file": "https://shop.example/assets/app.js",
        "line": 1,
        "description": "What yof saw (masked): sk_live_****9f2a"
      }
    ],
    "conditions": [],
    "execution": {
      "attacker_perspective": "Anyone who can reach the live app.",
      "payloads": [
        "sk_live_****9f2a"
      ],
      "instructions": [
        "Open https://shop.example/assets/app.js without signing in.",
        "What yof saw (masked): sk_live_****9f2a",
        "Expected instead: No live Stripe secret key appears in code that visitors can download."
      ],
      "observed_result": "What yof saw (masked): sk_live_****9f2a"
    },
    "remediation": {
      "strategy": "Remove the Stripe secret key (it starts with sk_live_) from all browser code and from any environment variable the browser can read. Create payments on the server only (an API route, server action or Supabase Edge Function) and send the browser just the client secret of the payment. The browser should only ever see the publishable key (pk_live_). Never paste the real key into this chat, never print it, and do not invent a replacement key. Tell me when the code no longer contains it, so I can create a new key in the provider's dashboard and delete the old one (the old one has been public, so it must be replaced)."
    },
    "severity": {
      "likelihood": {
        "score": "critical",
        "reason": "yof saw it on the live app."
      },
      "impact": {
        "score": "critical",
        "reason": "Someone could sign in as another person or keep a session they should not have."
      },
      "overall_severity": "critical"
    },
    "confidence": {
      "score": "high",
      "reason": "yof saw it on the live app."
    }
  }
]