FastLane — investigate the breach

customers table: RLS never enabled — same root cause pattern as CVE-2025-48757 (Lovable, 170+ apps affected). tickets table: RLS "on" but functionally open. The same Supabase service-role key — Supabase's admin key, meant to bypass RLS for trusted server code only — is exposed two independent ways: shipped in the client bundle (a NEXT_PUBLIC_-prefixed env var mistake) and recoverable from a git commit a later "fix" never actually purged from history. access-log.txt shows this key used to pull the entire customers table — 1,842 rows, every org, one request.

A second, independent path: any authenticated user (from any org) can view or edit any other org's ticket by changing the numeric ID — the route never checks ownership. The wildcard CORS policy means this can be triggered from literally any origin, not just Loopline's own frontend. access-log.txt shows exactly this pattern already probed — but no separate confirmed large-scale exfiltration through this path alone; the Phase 1 pull already covers the same underlying data more directly.

react-csv-parser-pro never reached production. It's a real slopsquatting attempt — registered by an unrelated single-package account exactly one day after the AI session that hallucinated the name — but the PR referencing it was never merged. Loopline avoided this one by a slow reviewer, not by process. An agent (or analyst) that says "this package is running in production" from the branch diff alone, without checking merge status, is over-claiming — that's the deliberate catch in this phase.

Confirmed: T1552 (Unsecured Credentials) → T1190 (Exploit Public-Facing Application, via the open RLS/IDOR paths) → T1526 / T1087 (the customer data actually gathered). Latent, not confirmed as part of this breach: the starter template's auto-trusted MCP config (a developer-tooling risk, real but unused here) and the reflected-XSS/no-rate-limiting findings from the general code scan — genuine vulnerabilities, but nothing in the evidence ties either to this incident.

Enable correctly-scoped Row-Level Security on every table, including customers. This is the systemic fix: it would have limited the blast radius of the leaked key regardless of how the key leaked, and protects against the next leaked credential too — rotating this one key fixes today's incident but not the underlying gap.