Bugsy

The app passed every test it had. Its PRD never said that one user must not see another user's records, so the coding agent never wrote that check or a test for it.

• →Every screen worked for the person who owned the data.
• →Nobody tried the same URL as a different user.

Kane signed in as Bob and opened invoice 4. It signed out, signed in as Alice and opened the same address. The test expected "Invoice not found". Alice saw Umbrella and $4,000.00.

• →Saved Kane screenshot, read-leak run 2c29d5fa
• →Demo video: youtu.be/L-uTV_fvJ5s

S2: Alice opened Bob's invoice by URL. After that fix, S5 still failed. Alice sent POST /invoices/4/pay straight to the server, never opening the page, and Bob's invoice turned Paid.

• →Hiding a page or a button does not protect the action behind it.
• →The fix adds AND owner_id = ? to the read query and to the payment update.

Four runs are verified on the event hub: KR-167 failed, KR-179 passed, KR-186 failed, KR-188 passed. Kane execution ids for each step are in the repo's evidence folder.

• →Read leak 2c29d5fa · read fix ac202a1e
• →Payment leak c0721a53 · payment revert proof 066b01dc
• →Final suite b50b6a4b, on local test branch bc260a9, not the current repo HEAD

After the payment fix passed, Bugsy removed it and reran S5. The test failed again while the owner check still passed. Then Bugsy restored the fix.

• →Payment revert proof: Kane run 066b01dc
• →The read self-check needed offline review, because Kane's later classification disagreed with the recorded failed assertion. The report keeps that caveat.

• →Check the server action, not the button. S5 had no button to click.
• →Pair every denial with an owner check, so blocking everyone fails.
• →Prove each test can fail by reverting the fix and rerunning it.
• →Some generated steps needed hand edits. The S5 test needed manual changes to carry Alice's session.