{
  "schemaVersion": 1,
  "skillId": "supabase-postgres-best-practices",
  "revision": "c9be0e931b7930f7d02126d04774d904c381e7d7",
  "runAt": "2026-10-19",
  "mode": "source-review",
  "summary": "Completed 6 bounded source checks covering requirements, workflow boundaries and practical security concerns. No skill workflow was executed.",
  "sourceManifest": [
    {
      "path": "skills/supabase-postgres-best-practices/SKILL.md",
      "sha256": "ad65e776f45e761bafc609d3f506c77c1032225aa65e0c4c02f241b8071e5855",
      "sourceUrl": "https://github.com/supabase/agent-skills/blob/c9be0e931b7930f7d02126d04774d904c381e7d7/skills/supabase-postgres-best-practices/SKILL.md"
    },
    {
      "path": "LICENSE",
      "sha256": "b65e575eb4f04a13c187d64e958321298e2ab84d67aa8428819f362056ba292c",
      "sourceUrl": "https://github.com/supabase/agent-skills/blob/c9be0e931b7930f7d02126d04774d904c381e7d7/LICENSE"
    },
    {
      "path": "skills/supabase-postgres-best-practices/references/security-rls-basics.md",
      "sha256": "e04dd1a3a382aafdaaa73fe9f7976352acdde6e90c2a2470d281b94d4f44b096",
      "sourceUrl": "https://github.com/supabase/agent-skills/blob/c9be0e931b7930f7d02126d04774d904c381e7d7/skills/supabase-postgres-best-practices/references/security-rls-basics.md"
    },
    {
      "path": "skills/supabase-postgres-best-practices/references/security-privileges.md",
      "sha256": "095909274a4fb43df785d7144cf674eeb40284d2d45628f14af4108737b93663",
      "sourceUrl": "https://github.com/supabase/agent-skills/blob/c9be0e931b7930f7d02126d04774d904c381e7d7/skills/supabase-postgres-best-practices/references/security-privileges.md"
    },
    {
      "path": "skills/supabase-postgres-best-practices/references/security-rls-performance.md",
      "sha256": "2e1faeca7d5746e246b1c78f9492fe2a9cfa41c4d7fa1e23c402d58fa18ea014",
      "sourceUrl": "https://github.com/supabase/agent-skills/blob/c9be0e931b7930f7d02126d04774d904c381e7d7/skills/supabase-postgres-best-practices/references/security-rls-performance.md"
    },
    {
      "path": "skills/supabase-postgres-best-practices/references/monitor-explain-analyze.md",
      "sha256": "4cb67ffbf8e57f2e5b380b0beb4242528b513723ce314a2c2ffcf083bd4203d7",
      "sourceUrl": "https://github.com/supabase/agent-skills/blob/c9be0e931b7930f7d02126d04774d904c381e7d7/skills/supabase-postgres-best-practices/references/monitor-explain-analyze.md"
    },
    {
      "path": "skills/supabase-postgres-best-practices/references/query-missing-indexes.md",
      "sha256": "91ad8b0ff4365704b4830a7f077c6f140f7140fd5d3ce5cd0b92b160cf9e25f1",
      "sourceUrl": "https://github.com/supabase/agent-skills/blob/c9be0e931b7930f7d02126d04774d904c381e7d7/skills/supabase-postgres-best-practices/references/query-missing-indexes.md"
    },
    {
      "path": "skills/supabase-postgres-best-practices/references/conn-pooling.md",
      "sha256": "88cf086bf98ba865d2e9d0579974e1366b14157619d6a93e7da77be91084e4a5",
      "sourceUrl": "https://github.com/supabase/agent-skills/blob/c9be0e931b7930f7d02126d04774d904c381e7d7/skills/supabase-postgres-best-practices/references/conn-pooling.md"
    }
  ],
  "cases": [
    {
      "id": "rule-routing",
      "method": "source-review; exact source condition checked, no workflow executed",
      "sourceUrl": "https://github.com/supabase/agent-skills/blob/c9be0e931b7930f7d02126d04774d904c381e7d7/skills/supabase-postgres-best-practices/SKILL.md",
      "expected": "Read individual rule files for detailed explanations and SQL examples",
      "observed": "The entrypoint routes readers to separate topic rules; reading it alone is not the full guide.",
      "passed": true
    },
    {
      "id": "tenant-policy-identity",
      "method": "source-review; exact source condition checked, no workflow executed",
      "sourceUrl": "https://github.com/supabase/agent-skills/blob/c9be0e931b7930f7d02126d04774d904c381e7d7/skills/supabase-postgres-best-practices/references/security-rls-basics.md",
      "expected": "current_setting('app.current_user_id')::bigint",
      "observed": "The generic RLS example trusts a session setting. Real isolation depends on who can set the identity and which roles execute the query.",
      "passed": true
    },
    {
      "id": "least-privilege",
      "method": "source-review; exact source condition checked, no workflow executed",
      "sourceUrl": "https://github.com/supabase/agent-skills/blob/c9be0e931b7930f7d02126d04774d904c381e7d7/skills/supabase-postgres-best-practices/references/security-privileges.md",
      "expected": "Never use superuser for application queries.",
      "observed": "The security guidance explicitly distinguishes narrowly granted application roles from a superuser.",
      "passed": true
    },
    {
      "id": "definer-boundary",
      "method": "source-review; exact source condition checked, no workflow executed",
      "sourceUrl": "https://github.com/supabase/agent-skills/blob/c9be0e931b7930f7d02126d04774d904c381e7d7/skills/supabase-postgres-best-practices/references/security-rls-performance.md",
      "expected": "set search_path = ''",
      "observed": "The reviewed definer example clears search_path and checks auth.uid(); permissions still need testing as the actual caller.",
      "passed": true
    },
    {
      "id": "query-execution",
      "method": "source-review; exact source condition checked, no workflow executed",
      "sourceUrl": "https://github.com/supabase/agent-skills/blob/c9be0e931b7930f7d02126d04774d904c381e7d7/skills/supabase-postgres-best-practices/references/monitor-explain-analyze.md",
      "expected": "EXPLAIN ANALYZE executes the query",
      "observed": "The diagnostic example is an executed query, not a read-only planner estimate.",
      "passed": true
    },
    {
      "id": "pooling-scope",
      "method": "source-review; exact source condition checked, no workflow executed",
      "sourceUrl": "https://github.com/supabase/agent-skills/blob/c9be0e931b7930f7d02126d04774d904c381e7d7/skills/supabase-postgres-best-practices/references/conn-pooling.md",
      "expected": "connection returned after each transaction",
      "observed": "The reviewed pooling note distinguishes connection reuse modes; workload compatibility must be checked separately.",
      "passed": true
    }
  ],
  "results": {
    "passed": 6,
    "failed": 0,
    "total": 6
  },
  "findings": [
    {
      "severity": "high",
      "title": "A tenant setting is not authentication",
      "detail": "The generic policy example reads app.current_user_id. If a caller can choose or overwrite that value, the example alone does not prove tenant isolation. Test trusted identity setup and both allowed and denied rows under the actual application role."
    },
    {
      "severity": "high",
      "title": "Privileged helpers need caller-role tests",
      "detail": "SECURITY DEFINER guidance crosses a privilege boundary. Verify schema exposure, search_path, EXECUTE grants and identity checks together; the sample revokes direct execution from named roles, so validate the intended policy call path before using it."
    },
    {
      "severity": "attention",
      "title": "Diagnostics and migrations can change state",
      "detail": "EXPLAIN ANALYZE executes its query; schema, index and role examples also change the database. Use a disposable database or a reviewed maintenance plan before applying generated SQL."
    },
    {
      "severity": "info",
      "title": "Performance figures were not reproduced",
      "detail": "The source contains example timing and speedup claims. IonBin did not execute those workloads or adopt those figures as measured results."
    }
  ],
  "limitations": [
    "Source review of the entrypoint and six selected rules; not every rule in the repository. No Postgres process, SQL query, migration, Supabase project or authenticated RLS session was executed.",
    "No performance gain, tenant isolation guarantee, permission correctness, connection-pool compatibility or version-wide security conclusion is established."
  ],
  "methodology": "Each source check records the exact source condition and the scoped observation it supports. Counts measure reviewed conditions, not completed user tasks, security assurance or model effectiveness."
}