The app passed every test it had. Its PRD never said that one user must not see another user's records, so the coding agent never wrote that check or a test for it.

• Every screen worked for the person who owned the data.
• Nobody tried the same URL as a different user.

Kane signed in as Bob and opened invoice 4. It signed out, signed in as Alice and opened the same address. The test expected "Invoice not found". Alice saw Umbrella and $4,000.00.

• Saved Kane screenshot, read-leak run 2c29d5fa
• Demo video: youtu.be/L-uTV_fvJ5s

1. You write the rule. Alice owns invoices 1 to 3, Bob owns 4 to 6.
2. OpenAI turns it into two-account scenarios. Every denial ships with an owner check.
3. Kane CLI runs them in Chrome as Bob, then as Alice.
4. Codex patches the server from Kane's failure record and screenshot.
5. Kane reruns the same tests on the patched build.
6. Bugsy reverts the patch and reruns. The test has to go red again.

S2: Alice opened Bob's invoice by URL. After that fix, S5 still failed. Alice sent POST /invoices/4/pay straight to the server, never opening the page, and Bob's invoice turned Paid.

• Hiding a page or a button does not protect the action behind it.
• The fix adds AND owner_id = ? to the read query and to the payment update.

1. S1 · Alice opens her own invoice · passes on both builds
2. S2 · Alice opens Bob's invoice by URL · leak, then Invoice not found
3. S3 · Alice's list shows only her invoices · passes on both
4. S4 · Back button after sign-out shows Sign in · passes on both
5. S5 · Alice pays Bob's invoice with a raw POST · Paid, then 404 and still Unpaid

Four runs are verified on the event hub: KR-167 failed, KR-179 passed, KR-186 failed, KR-188 passed. Kane execution ids for each step are in the repo's evidence folder.

• Read leak 2c29d5fa · read fix ac202a1e
• Payment leak c0721a53 · payment revert proof 066b01dc
• Final suite b50b6a4b, on local test branch bc260a9, not the current repo HEAD

After the payment fix passed, Bugsy removed it and reran S5. The test failed again while the owner check still passed. Then Bugsy restored the fix.

• Payment revert proof: Kane run 066b01dc
• The read self-check needed offline review, because Kane's later classification disagreed with the recorded failed assertion. The report keeps that caveat.

• Check the server action, not the button. S5 had no button to click.
• Pair every denial with an owner check, so blocking everyone fails.
• Prove each test can fail by reverting the fix and rerunning it.
• Some generated steps needed hand edits. The S5 test needed manual changes to carry Alice's session.

npx bugsy scan, npx bugsy patch, npx bugsy self-check

0 leaks Cross-account leaks still open after the Codex patch (baseline 2; source: Kane runs 167 (vulnerable build) and 188 (patched build))

5 scenarios Ownership scenarios passing (out of 5) (baseline 3; source: Kane runs 167 (vulnerable build) and 188 (patched build))

Next: a second app, and rules for shared records and staff access.

Scope today: the Ledger demo, sequential accounts, and the rules you state. Five passing checks do not make an app secure.

https://github.com/aayushkhator1994/bugsy · Aayush Khator