AI Ctrf

Tool description integrity

nothing to read

Pattern set 1.0 matched nothing on 2026-10-05, but none of the descriptions the package ships runs to 120 characters, so there was little for a rule to read.

It reads the descriptions the package ships, not what the server says when it runs, and a clean description is not the same thing as a safe tool.

Row-level security

nothing to read

No Supabase migrations in the 18 files of the published package read on 2026-10-01, so there was nothing for this check to read.

Not covered: A reading of files cannot prove a policy is enforced at run time: whether these migrations were applied, whether row-level security was switched on another way (the dashboard, SQL run by hand), or what a table holds. A database only the app's own server can reach (SQLite, or Postgres behind a server that holds the only connection) needs no row-level security for this reason, and its migrations are not read.

Object-level authorisation

nothing to read

No Supabase migrations in the 18 files of the published package read on 2026-10-01, so there was nothing for this check to read.

Not covered: Whether the app means every account to edit everything (an admin tool whose only account is its owner's), whether sign-up is open (a dashboard setting), and anything about a policy whose expression looks at the row. Whether the migrations were applied is not known. Policies that let anyone read every row are not counted here.

CORS configuration

no match, 17 code files read

App check set 1.0 matched nothing across 17 code files, 18 files of the published package read on 2026-10-01.

Not covered: Whether it matters. A server that checks a token sent in a header gives a foreign page nothing it could not do without the browser, and a server bound to the loopback address is reachable only from pages open on the same machine (which is still every page that machine opens). A value chosen at run time, such as a variable that falls back to *, is not read: the hand count found one such server, and it is not in the figure.

Not covered: Whether the server reads cookies at all, whether the echo is guarded by a check this reading does not follow, and anything decided at run time.

No shipped credentials

no match, 18 files read

App check set 1.0 matched no credential in a format it recognises, bundles included, across the 18 files of the published package read on 2026-10-01.

Not covered: Whether a key still works (none is ever tried, because trying one would be using it), credentials in formats the check does not name, anything in a repository's history, and files the nightly reading does not reach when a package is over its caps.

Published because it was found. A finding is information about where the limits are, not a verdict that the software is unsafe.