{
  "recorded_at": "2026-09-28T10:56:47.676737+00:00",
  "python": "3.14.7",
  "scope": "Local HTTP example with synthetic sessions and in-memory provider stub. Not a Lovable export, Vite build, Supabase Auth test, browser execution or real provider rotation.",
  "source_sha256": "e85492a73affdbed00a1a318ae003e0fc28bbff8d3e2e073866dbcb0ed9fe115",
  "passed": 15,
  "checks": [
    {
      "case": "HTML served without privileged key",
      "passed": true
    },
    {
      "case": "public marker is visible in JavaScript",
      "passed": true
    },
    {
      "case": "scan detects intentionally exposed synthetic secret",
      "passed": true
    },
    {
      "case": "served JavaScript contains neither provider key",
      "passed": true
    },
    {
      "case": "anonymous denied",
      "passed": true
    },
    {
      "case": "public key is not a user session",
      "passed": true
    },
    {
      "case": "foreign tenant denied",
      "passed": true
    },
    {
      "case": "arbitrary provider URL rejected",
      "passed": true
    },
    {
      "case": "denied requests did not reach provider",
      "passed": true
    },
    {
      "case": "authorized request succeeds",
      "passed": true
    },
    {
      "case": "creating a second key does not revoke the first",
      "passed": true
    },
    {
      "case": "backend works with replacement",
      "passed": true
    },
    {
      "case": "old key fails after explicit revocation",
      "passed": true
    },
    {
      "case": "backend remains available after revocation",
      "passed": true
    },
    {
      "case": "stale backend fails without leaking credential",
      "passed": true
    }
  ]
}