{
  "schemaVersion": 1,
  "checkedOn": "2026-10-28",
  "scope": "Selected source facts and an executed local synthetic database fixture. No ranking opinions or numerical scores changed.",
  "records": [
    {
      "id": "tool-gitea",
      "url": "https://about.gitea.com",
      "finalURL": "https://about.gitea.com",
      "status": 200,
      "readAt": "2026-10-28T13:22:39.508390+00:00",
      "sha256": "6902177caaeee2befeb4e19bfc771adf6935d54fd98ba4f95bb995fd25e124dc",
      "iconCandidates": [
        "/favicon.ico",
        "/gitea.svg",
        "/gitea.svg",
        "/gitea.png"
      ],
      "verificationRenewed": false,
      "claim": "Self-hosted MIT-licensed edition supports Git repositories, issues and Actions; hosting resources are separate.",
      "excerpt": "Free, self-hosted Git service under the MIT license.",
      "checkedOn": "2026-10-28",
      "scope": "Self-hosted MIT-licensed edition supports Git repositories, issues and Actions; hosting resources are separate.",
      "region": "Public English page; no regional account session",
      "currency": null,
      "billingUnit": null,
      "limitations": "Selected documentation only, not product performance or account entitlement.",
      "researchVerified": true
    },
    {
      "id": "price-buffer",
      "url": "https://buffer.com/pricing?cta=bufferSite-globalNav-pricing-pricing-1",
      "finalURL": "https://buffer.com/pricing?cta=bufferSite-globalNav-pricing-pricing-1",
      "status": 200,
      "readAt": "2026-10-28T13:22:40.128529+00:00",
      "sha256": "99e63339e5eb0f769d97209e3a9a145212161f0dc370ff7ce03243a0e1958206",
      "iconCandidates": [
        "/icons/favicon-32x32.png",
        "/icons/favicon.svg",
        "/icons/apple-touch-icon.png",
        "/icons/buffer-icon.svg"
      ],
      "verificationRenewed": false,
      "claim": "Free queue and one-channel annual quotes; unresolved dollar currency.",
      "excerpt": "Connect up to 3 channels",
      "checkedOn": "2026-10-28",
      "scope": "Free queue and one-channel annual quotes; unresolved dollar currency.",
      "region": "Public English page; no regional account session",
      "currency": null,
      "billingUnit": null,
      "limitations": "Selected documentation only, not product performance or account entitlement.",
      "researchVerified": true
    },
    {
      "id": "tool-gleap",
      "url": "https://gleap.io",
      "finalURL": "https://www.gleap.ai/",
      "status": 200,
      "readAt": "2026-10-28T13:22:41.947537+00:00",
      "sha256": "8bba1dce017ab84fbb5ad195112a3fc846608b63fc94ed8e8f7f480766fc7f3f",
      "iconCandidates": [
        "/favicon.svg",
        "/favicon.webp",
        "/favicon.webp",
        "/webclip.webp"
      ],
      "verificationRenewed": false,
      "claim": "Seven-day trial; Starter £25/month equivalent and Team £109/month equivalent, both annual; per-resolution charges separate.",
      "excerpt": "Every plan starts with a 7-day free trial.",
      "checkedOn": "2026-10-28",
      "scope": "Seven-day trial; Starter £25/month equivalent and Team £109/month equivalent, both annual; per-resolution charges separate.",
      "region": "Public English page; no regional account session",
      "currency": "GBP",
      "billingUnit": "account/year plus usage",
      "limitations": "Selected documentation only, not product performance or account entitlement.",
      "researchVerified": true
    },
    {
      "id": "price-buttondown",
      "url": "https://buttondown.com/pricing",
      "finalURL": "https://buttondown.com/pricing",
      "status": 200,
      "readAt": "2026-10-28T13:22:41.491981+00:00",
      "sha256": "8fb99441c96e96cab93aeaea636a868aad403a0cf794a3c3a460708b4454b90d",
      "iconCandidates": [
        "https://static-assets.buttondown.com/images/icons/icon@72.png",
        "https://static-assets.buttondown.com/images/icons/icon@192.png",
        "https://static-assets.buttondown.com/images/icons/icon-square@144.png"
      ],
      "verificationRenewed": false,
      "claim": "First 100 subscribers free; at most one whole-list email a day, paid upgrades separate. Existing paid interactive quotes not reverified.",
      "excerpt": "Absolutely nothing for your first 100 subscribers.",
      "checkedOn": "2026-10-28",
      "scope": "First 100 subscribers free; at most one whole-list email a day, paid upgrades separate. Existing paid interactive quotes not reverified.",
      "region": "Public English page; no regional account session",
      "currency": null,
      "billingUnit": null,
      "limitations": "Selected documentation only, not product performance or account entitlement.",
      "researchVerified": true
    },
    {
      "id": "price-capacities",
      "url": "https://capacities.io/pricing",
      "finalURL": "https://capacities.io/pricing",
      "status": 200,
      "readAt": "2026-10-28T13:22:48.482759+00:00",
      "sha256": "72f4729db1a9d8c225473552f6df4df39246bbad03ebce74c985b618ec8a632c",
      "iconCandidates": [
        "/favicon.ico",
        "/favicon-32x32.png",
        "/favicon-16x16.png",
        "/favicon.png"
      ],
      "verificationRenewed": false,
      "claim": "Basic free plan with 5 GB media then 100 MB per month; paid AI budgets separate.",
      "excerpt": "100 MB per month afterwards",
      "checkedOn": "2026-10-28",
      "scope": "Basic free plan with 5 GB media then 100 MB per month; paid AI budgets separate.",
      "region": "Public English page; no regional account session",
      "currency": null,
      "billingUnit": null,
      "limitations": "Selected documentation only, not product performance or account entitlement.",
      "researchVerified": true
    },
    {
      "id": "drizzle-pglite",
      "url": "https://orm.drizzle.team/docs/connect-pglite",
      "finalURL": "https://orm.drizzle.team/docs/connect-pglite",
      "status": 200,
      "readAt": "2026-10-28T13:22:49.496434+00:00",
      "sha256": "c8d7bff3eeac6c3d58be7b707c0401f23157185ef127a70d5e86a7cade151f39",
      "iconCandidates": [
        "/favicon.ico"
      ],
      "verificationRenewed": false,
      "claim": "Drizzle supports PGlite as a local PostgreSQL driver.",
      "excerpt": "PGlite",
      "checkedOn": "2026-10-28",
      "scope": "Drizzle supports PGlite as a local PostgreSQL driver.",
      "region": "Public English page; no regional account session",
      "currency": null,
      "billingUnit": null,
      "limitations": "Selected documentation only, not product performance or account entitlement.",
      "researchVerified": true
    },
    {
      "id": "pglite-docs",
      "url": "https://pglite.dev/docs/",
      "finalURL": "https://pglite.dev/docs/",
      "status": 200,
      "readAt": "2026-10-28T13:22:50.325072+00:00",
      "sha256": "248065b7652460146948d0e0164a13ed9ca6d3ed467ff38c6a8a2df74c96064e",
      "iconCandidates": [
        "/img/favicons/favicon-16x16.png",
        "/img/favicons/favicon-32x32.png",
        "/img/favicons/apple-touch-icon.png",
        "/img/brand/icon-light.svg"
      ],
      "verificationRenewed": false,
      "claim": "PGlite runs PostgreSQL locally with one exclusive connection.",
      "excerpt": "single exclusive connection",
      "checkedOn": "2026-10-28",
      "scope": "PGlite runs PostgreSQL locally with one exclusive connection.",
      "region": "Public English page; no regional account session",
      "currency": null,
      "billingUnit": null,
      "limitations": "Selected documentation only, not product performance or account entitlement.",
      "researchVerified": true
    },
    {
      "id": "postgres-rls",
      "url": "https://www.postgresql.org/docs/18/ddl-rowsecurity.html",
      "finalURL": "https://www.postgresql.org/docs/18/ddl-rowsecurity.html",
      "status": 200,
      "readAt": "2026-10-28T13:22:52.749442+00:00",
      "sha256": "645472df870717eb85d99640154ce1f4a415fd690094fe7786e04bcd465418c3",
      "iconCandidates": [
        "/favicon.ico"
      ],
      "verificationRenewed": false,
      "claim": "RLS policy does not normally constrain owner; BYPASSRLS roles bypass policies.",
      "excerpt": "BYPASSRLS",
      "checkedOn": "2026-10-28",
      "scope": "RLS policy does not normally constrain owner; BYPASSRLS roles bypass policies.",
      "region": "Public English page; no regional account session",
      "currency": null,
      "billingUnit": null,
      "limitations": "Selected documentation only, not product performance or account entitlement.",
      "researchVerified": true
    },
    {
      "id": "supabase-rls",
      "url": "https://supabase.com/docs/guides/database/postgres/row-level-security",
      "finalURL": "https://supabase.com/docs/guides/database/postgres/row-level-security",
      "status": 200,
      "readAt": "2026-10-28T13:22:51.123528+00:00",
      "sha256": "5bc41d764821b89e359a609df65df07265ab501ca482c458855136499dc538f6",
      "iconCandidates": [
        "/docs/favicon/favicon.ico",
        "/docs/favicon/apple-icon-180x180.png"
      ],
      "verificationRenewed": false,
      "claim": "Supabase RLS/authentication paths need separate validation from database-role fixture.",
      "excerpt": "Row Level Security",
      "checkedOn": "2026-10-28",
      "scope": "Supabase RLS/authentication paths need separate validation from database-role fixture.",
      "region": "Public English page; no regional account session",
      "currency": null,
      "billingUnit": null,
      "limitations": "Selected documentation only, not product performance or account entitlement.",
      "researchVerified": true
    },
    {
      "id": "glitch-closure",
      "url": "https://blog.glitch.com/post/changes-are-coming-to-glitch/",
      "checkedOn": "2026-10-28",
      "eventDate": "2025-07-08",
      "claim": "Glitch project hosting ended 8 July 2025; historical availability correction.",
      "excerpt": "Glitch project hosting and user profiles will be shut down.",
      "scope": "Hosting lifecycle, not a new product announcement.",
      "primarySource": true,
      "researchVerified": true
    }
  ],
  "localRun": {
    "runAt": "2026-10-28T13:21:43.100Z",
    "scope": "Executed local in-memory PGlite WASM PostgreSQL through Drizzle ORM. Synthetic rows and fixed database roles only.",
    "versions": {
      "pglite": "0.5.13",
      "drizzleOrm": "0.45.4",
      "node": "v25.6.1",
      "postgres": "PostgreSQL 18.6 (PGlite 0.5.13) on wasm32-unknown-emscripten, compiled by emcc (Emscripten gcc/clang-like replacement + linker emulating GNU ld) 6.0.5 (1db513782be24469589d7cb8a1f1834e9a33f271), 32-bit"
    },
    "limitations": [
      "Single local connection; no concurrency or pooler test.",
      "No hosted Supabase account, Data API, auth.uid(), JWT, network deployment or migration tested.",
      "A small demonstration, not a security audit or proof of application isolation."
    ],
    "cases": [
      {
        "id": "01-grants-without-rls",
        "expected": [
          1,
          2
        ],
        "actual": [
          1,
          2
        ],
        "pass": true,
        "context": "Drizzle select with table grants but RLS disabled exposes both fixture tenants."
      },
      {
        "id": "02-default-deny",
        "expected": [],
        "actual": [],
        "pass": true,
        "context": "RLS enabled with no policy: non-owner sees no rows."
      },
      {
        "id": "03-tenant-a-read",
        "expected": [
          1
        ],
        "actual": [
          1
        ],
        "pass": true,
        "context": "Policy uses PostgreSQL current_user, not Supabase auth.uid()."
      },
      {
        "id": "04-tenant-b-read",
        "expected": [
          2
        ],
        "actual": [
          2
        ],
        "pass": true,
        "context": "Second database role sees only its own row through the same Drizzle query."
      },
      {
        "id": "05-own-insert",
        "expected": [
          3
        ],
        "actual": [
          3
        ],
        "pass": true,
        "context": "Allowed tenant-scoped write."
      },
      {
        "id": "06-cross-insert",
        "expected": "42501",
        "actual": "42501",
        "pass": true,
        "context": "WITH CHECK rejects a cross-tenant insert."
      },
      {
        "id": "07-cross-update",
        "expected": [],
        "actual": [],
        "pass": true,
        "context": "Hidden target produces zero updated rows; a successful SQL request is not proof of access."
      },
      {
        "id": "08-reassign-owner",
        "expected": "42501",
        "actual": "42501",
        "pass": true,
        "context": "WITH CHECK prevents changing an accessible row to another tenant."
      },
      {
        "id": "09-cross-delete",
        "expected": [],
        "actual": [],
        "pass": true,
        "context": "Policy hides another tenant’s row from deletion."
      },
      {
        "id": "10-table-owner-bypass",
        "expected": [
          1,
          2,
          3
        ],
        "actual": [
          1,
          2,
          3
        ],
        "pass": true,
        "context": "Table owner normally bypasses RLS even when it is enabled."
      },
      {
        "id": "11-forced-owner",
        "expected": [],
        "actual": [],
        "pass": true,
        "context": "Forced RLS subjects ordinary table owner to the policy; no row has tenant app_owner."
      },
      {
        "id": "12-bypassrls-role",
        "expected": [
          1,
          2,
          3
        ],
        "actual": [
          1,
          2,
          3
        ],
        "pass": true,
        "context": "An explicitly privileged BYPASSRLS database role bypasses even forced RLS. No Supabase service key is used."
      },
      {
        "id": "13-rollback",
        "expected": [
          1,
          3
        ],
        "actual": [
          1,
          3
        ],
        "pass": true,
        "context": "An intentionally aborted Drizzle transaction leaves no id 5 row."
      },
      {
        "id": "14-other-tenant-unchanged",
        "expected": [
          {
            "id": 2,
            "tenant": "tenant_b",
            "body": "B synthetic draft"
          }
        ],
        "actual": [
          {
            "id": 2,
            "tenant": "tenant_b",
            "body": "B synthetic draft"
          }
        ],
        "pass": true,
        "context": "After denied/zero-row writes, tenant B’s original fixture remains unchanged."
      }
    ],
    "passed": 14,
    "total": 14
  },
  "download": {
    "href": "/downloads/drizzle-rls-local-lab-2026-10-28.zip",
    "sha256": "05394883537e1e89bec19bdb1398ccad649656d1e631744e00191e0a1360ba3d"
  }
}