{
  "schemaVersion": 1,
  "recordedAt": "2026-10-30T21:41:18.253Z",
  "sourceRevision": "ecf3133a98be4bc45e06fcbb87c02dcf152e09e3",
  "domain": "studio-demo.example",
  "location": "https://studio-demo.example/assets/app.js",
  "severity": "critical",
  "maskedEvidence": "eyJhbGci...",
  "before": {
    "findingCount": 1,
    "coverage": {
      "assessedTargets": 8,
      "targets": 8
    }
  },
  "after": {
    "findingCount": 0,
    "coverage": {
      "assessedTargets": 8,
      "targets": 8
    }
  },
  "blocked": {
    "findingCount": 0,
    "coverage": {
      "assessedTargets": 7,
      "targets": 8
    }
  },
  "safeLabPrompt": "LOCAL DEMONSTRATION ONLY. studio-demo.example is a reserved example hostname. The JWT is synthetic, expired, and invalid. Do not contact the hostname, use the token, rotate real credentials, or change any real project. Discuss only the local fixture and the general remediation approach.\n\nContext the AI should know:\n- Platform: unknown\n- Hosting: unknown\n- Owner of this finding: unknown\n- Actionability: fixable\n- Safety: unknown\n\nI need help fixing a security vulnerability found by unpwned.\n\n**Vulnerability:** Secret exposed in JavaScript bundle: Supabase service_role JWT (admin god-mode)\n**Severity:** critical | **Category:** Secrets & Credentials\n\n**What's wrong:**\nFound in: https://studio-demo.example/assets/app.js. Preview: eyJhbGci...\n\n**Why it matters:**\nHardcoded credentials are accessible to anyone who loads the page.\n\n**Steps to fix:**\n1. Remove the secret from your frontend code immediately.\n2. Rotate the exposed credential.\n3. Use environment variables on the server side instead.\n\nPlease provide the exact code changes needed to fix this completely. Be specific, production-ready, and show the full implementation.",
  "scope": "Recorded synthetic response fixtures from October 2026. No live scan, customer data, valid credential, payment or deployment is part of this demonstration.",
  "limitations": [
    "The example demonstrates one token pattern in one readable JavaScript fixture, not an entire application.",
    "The expired token has an invalid signature. Detection does not establish credential validity or access.",
    "Changing a fixture does not verify key rotation, backend authorization or deployment.",
    "A blocked response leaves the earlier finding unverified, even when the result has zero findings.",
    "This historical lab record is not a replay of the currently deployed product."
  ]
}