{
  "summary": {
    "files": 1,
    "tables": 3,
    "rls_enabled": 2,
    "high": 2,
    "medium": 1,
    "low": 0,
    "info": 0
  },
  "tables": [
    {
      "table": "public.payments",
      "rls": false,
      "policies": 0
    },
    {
      "table": "public.posts",
      "rls": true,
      "policies": 1
    },
    {
      "table": "public.todos",
      "rls": true,
      "policies": 1
    }
  ],
  "findings": [
    {
      "severity": "high",
      "rule": "rls-disabled",
      "target": "public.payments",
      "message": "Row level security is off. Anyone with your public anon key can read and change every row through the API.",
      "fix": "alter table public.payments enable row level security;",
      "file": "0001_init.sql"
    },
    {
      "severity": "high",
      "rule": "policy-any-user-write",
      "target": "public.todos / todos any user",
      "message": "FOR ALL only checks that someone is signed in, so any user can read and change other users' rows.",
      "fix": "Compare the row's owner column with (select auth.uid()) instead.",
      "file": "0001_init.sql"
    },
    {
      "severity": "medium",
      "rule": "policy-public-read",
      "target": "public.posts / public posts",
      "message": "USING (true) for anon or public: the whole table is readable by anyone on the internet. Fine for truly public data (blog posts, pricing), a leak for anything else.",
      "fix": "If it is not meant to be public, restrict to authenticated and scope to the owner.",
      "file": "0001_init.sql"
    }
  ]
}