verify_jwt is not authentication

Supabase edge functions have a setting called verify_jwt, and switching it on feels like locking the door. The first version of Rhomn Scan's rule for unauthenticated functions believed that too, and went looking for the ones configured with the setting turned off. Run across two real codebases holding twelve genuine problems between them, it found two.

What the setting actually demands is a valid JWT signed by the project, and the anonymous key is exactly that. It ships inside the browser bundle, frequently hardcoded in the client source, so reading it takes about thirty seconds. Switching verify_jwt on narrows the set of people who can call a function from anyone who knows the URL to anyone who knows the URL and has opened developer tools once.

The ten it missed were not subtle. One repository had no functions section in its configuration at all, so a rule keyed to that section scored zero against four functions that ran with the service role and never asked who was calling. Another held two nearly identical functions for connecting a bot, and the rule flagged one of them, for no better reason than a configuration entry existing for that one and not for its twin.

The rewrite stopped treating configuration as evidence. Every function in the project is a candidate now, the check for authentication happens in the code itself and follows whatever wrapper it has been buried under, and the configuration is still read, only to word the finding rather than to decide it. A function with the setting off can be called with nothing at all, one with it on can be called with a key anybody can copy, and the report calls both of them anonymous callers, because that is what they are.

Severity moved onto the finding for the same reason. An open mail relay and a function that only burns its own bandwidth were both landing as high, which left the word meaning very little. The rule now carries ninety fixture cases taken from real repositories, and forty-seven of them are there to prove it stays quiet on code that merely looks similar.