{
  "experiment": "Thunkle two-account read isolation",
  "checkerVersion": "1.0.0",
  "measuredAt": "2026-09-09T16:37:50.699Z",
  "environment": "Disposable local Supabase; synthetic records only",
  "node": "v26.7.0",
  "supabaseCli": "2.115.0",
  "postgres": "17.6",
  "results": [
    {
      "configuration": "owner-scoped-rls",
      "status": "PASS",
      "checks": [
        {
          "name": "B reading A's private fixture",
          "status": "PASS"
        },
        {
          "name": "A reading B's private fixture",
          "status": "PASS"
        },
        {
          "name": "Signed-out request reading A's private fixture",
          "status": "PASS"
        },
        {
          "name": "Signed-out request reading B's private fixture",
          "status": "PASS"
        }
      ],
      "reason": "Results cover only these private fixture reads at this time. Writes, storage, RPCs and app endpoints are not covered."
    },
    {
      "configuration": "all-authenticated-rls",
      "status": "EXPOSED",
      "checks": [
        {
          "name": "B reading A's private fixture",
          "status": "EXPOSED"
        },
        {
          "name": "A reading B's private fixture",
          "status": "EXPOSED"
        },
        {
          "name": "Signed-out request reading A's private fixture",
          "status": "PASS"
        },
        {
          "name": "Signed-out request reading B's private fixture",
          "status": "PASS"
        }
      ],
      "reason": "Results cover only these private fixture reads at this time. Writes, storage, RPCs and app endpoints are not covered."
    },
    {
      "configuration": "rls-disabled-with-select-grants",
      "status": "EXPOSED",
      "checks": [
        {
          "name": "B reading A's private fixture",
          "status": "EXPOSED"
        },
        {
          "name": "A reading B's private fixture",
          "status": "EXPOSED"
        },
        {
          "name": "Signed-out request reading A's private fixture",
          "status": "EXPOSED"
        },
        {
          "name": "Signed-out request reading B's private fixture",
          "status": "EXPOSED"
        }
      ],
      "reason": "Results cover only these private fixture reads at this time. Writes, storage, RPCs and app endpoints are not covered."
    },
    {
      "configuration": "rls-enabled-no-select-policy",
      "status": "INCONCLUSIVE",
      "checks": [],
      "reason": "Owner-read controls failed. Check fixtures, sessions, grants and policies."
    }
  ]
}