Antelier/ journeys
2026-09-08 11:40 UTC
JOURNEY REPORT · Northwind Bookings (demo app) · demo app (local) · 2026-09-08 11:40 UTC

5 of 5 journeys passed · no high findings · repair prepared

demo app; fixture audit

Browser journeys ran against the demo app. Access findings come from labelled fixture audit files; no live database was audited. The repair SQL was prepared, not applied.

Since the last run

First run for this app.

Journeys

passedsign up and reach the dashboard
as user a · 6 steps
1 · open /signup
passed
2 · fill Email
passed
3 · fill Password
passed
4 · click Sign up
passed
5 · url matches /dashboard
passed
6 · text "Welcome"
passed
Step 1 of 6
passedmake a booking and see it in the list
as user a · 9 steps
1 · open /signup
passed
2 · fill Email
passed
3 · fill Password
passed
4 · click Sign up
passed
5 · url matches /dashboard
passed
6 · fill Service
passed
7 · fill Date
passed
8 · click Book
passed
9 · text "Beard trim on 2026-09-30"
passed
Step 1 of 9
passedanother customer does not see that booking
as user b · 6 steps
1 · open /signup
passed
2 · fill Email
passed
3 · fill Password
passed
4 · click Sign up
passed
5 · url matches /dashboard
passed
6 · text "No bookings yet"
passed
Step 1 of 6
passedcancel the plan and lose dashboard access
as user a · 9 steps
1 · open /signup
passed
2 · fill Email
passed
3 · fill Password
passed
4 · click Sign up
passed
5 · open /settings
passed
6 · click Cancel plan
passed
7 · text "Plan cancelled"
passed
8 · open /dashboard
passed
9 · url matches /signup
passed
Step 1 of 9
passeda visitor who never signed up cannot open the dashboard
as a signed-out visitor · 3 steps
1 · open /dashboard
passed
2 · url matches /signup
passed
3 · text "Create your account"
passed
Step 1 of 3

Access findings

Audit receipt · fixture · migration revision not recorded
SeverityWhereWhat we foundEvidence
The access audit at time not recorded found no findings. Anonymous reads returned no rows on 1 of 1 table probed.

Finding → Repair → Verified

Finding

Run sample-failed-2026-09-08T11:40:12.804Z

TablePolicy / findingReceipt
bookingsrls-offAnyone with your public key can read and change every row in bookings.
Audit receipt · fixture · migration revision not recorded

another customer does not see that booking

Failing step 6: another customer does not see that booking
Observed failure at step 6. Open a step below for its receipt.
1 · open /signup
passed
2 · fill Email
passed
3 · fill Password
passed
4 · click Sign up
passed
5 · url matches /dashboard
passed
6 · text "No bookings yet"
failedlocator.waitFor: Timeout 10000ms exceeded.
Step 1 of 6

Repair

Demo app; fixture audit. Browser journeys and screenshots are real local runs. Audit results are supplied fixtures, not live database observations. SQL was prepared, not applied. The rerun uses the demo server with bookings-leak disabled; it does not prove the SQL fixed a database.

REPAIR.mdsupabase/migrations/20260908114025844_antelier_rls.sql

supabase/migrations/20260908114025844_antelier_rls.sql

-- Prepared by Antelier. Review policies before applying; no database changes have been made.
alter table public."bookings" enable row level security;
create policy "bookings: owners read" on public."bookings" for select using (auth.uid() = "user_id");
create policy "bookings: owners write" on public."bookings" for insert with check (auth.uid() = "user_id");
create policy "bookings: owners update" on public."bookings" for update using (auth.uid() = "user_id") with check (auth.uid() = "user_id");
create policy "bookings: owners delete" on public."bookings" for delete using (auth.uid() = "user_id");

Verified rerun

Verified Run sample-2026-09-08T11:40:25.923Z · 2026-09-08 11:40 UTC

5 / 5 journeys passed: sign up and reach the dashboard, make a booking and see it in the list, another customer does not see that booking, cancel the plan and lose dashboard access, a visitor who never signed up cannot open the dashboard · 0 access findings

Audit receipt · fixture · migration revision not recorded

The finding is absent from a later comparable audit. These receipts do not prove the migration caused the result.

What this did not check

Demo app; fixture audit. Browser journeys and screenshots are real local runs. Audit results are supplied fixtures, not live database observations. SQL was prepared, not applied. The rerun uses the demo server with bookings-leak disabled; it does not prove the SQL fixed a database. · Only the configured journeys and assertions were checked. Browser visibility does not prove API isolation or physical data erasure. · Payments, other devices, third-party origins and unlisted workflows were not checked. · No migration was applied. Screenshots may contain app data; keep reports private. · Demo app: real browser run against the local Northwind fixture server. · Access audit source: fixture. No live database was inspected. · Stack: unknown; backend: unknown. Repository fingerprints do not prove the deployed stack or project ownership.

Northwind Bookings (demo app)

demo app; fixture audit · 2026-09-08 11:40 UTC · Run sample-2026-09-08T11:40:25.923Z

5 of 5 journeys passed · no high findings · repair prepared

Journeys

JourneyResult
sign up and reach the dashboardpassed
make a booking and see it in the listpassed
another customer does not see that bookingpassed
cancel the plan and lose dashboard accesspassed
a visitor who never signed up cannot open the dashboardpassed

Access findings

No findings in this audit.

Repair and rerun

supabase/migrations/20260908114025844_antelier_rls.sql

Verified rerun: sample-2026-09-08T11:40:25.923Z · 5 / 5 journeys; finding absent from comparable audit.

Sign-off covers only the recorded checks. Full screenshots, receipts and limitations remain in the report.

Agency signature
Date: __________________

Client signature
Date: __________________