docs(examples): use semantic owned database names

[seonghobae]

Naming repair

The AppGuardrail Next.js/Supabase teaching fixtures used organization-owned persistence with generic one-word database objects and fields: projects(id, user_id, name, data). That conflicts with the ContextualWisdomLab naming contract and teaches generated applications an ambiguous owned schema even when the security behavior is the lesson.

The fixed and intentionally vulnerable examples now use project_records(project_id, owner_user_id, project_name, project_payload) and semantic internal identifiers. Vendor-owned NextAuth/Supabase/Zod fields such as session.user.id, auth.users(id), and parse-result data remain at explicit adapter boundaries. The vulnerable fixture keeps its intentional security failures; naming ambiguity is no longer coupled to those failures.

Security-review repairs

Current-head review findings were repaired directly rather than delegated: the fixed sample preserves the existing url checkout response and /api/admin/users path, validates project UUID and checkout JSON input, rejects unsupported admin query input, authenticates the admin handler before processing that input, and derives the Python test fixture path from the repository root. Focused regressions pin these contracts and their order.

Database boundary

These are fresh illustrative schemas, not AppGuardrail production persistence. Existing applications already deployed with projects(id, user_id, name, data) require an explicit forward migration covering foreign keys, indexes, ORM/query mappings, RLS policies, UPSERT paths, locks/read-write behavior, rollback, and deployed consumers; this PR does not pretend a documentation rename is a safe live migration.

TDD / regression evidence

• tests/test_fixed_example_naming_contract.py pins semantic DB/query names, request-validation contracts, authentication-before-input handling, and existing sample API compatibility.
• tests/test_vulnerable_example_naming_contract.py requires the same semantic project vocabulary while explicitly asserting that the vulnerable fixture still lacks authentication/ownership and RLS.
• CHANGELOG.d/semantic-fixed-example-database-names.md records both fixtures and the compatibility boundary.

Exact identity

• protected base: develop@e71d37e7c58118e6764c96ab7c4492fe33eed6f8
• exact current head: e8a6b7a2b47d0deab02975f464587536eddf5526
• branch: fix/fixed-example-semantic-database-names

All observed review threads through the prior head were repaired/resolved. Fresh exact-head Tests, Security Process, Security Scan, SAST Semgrep, OpenSSF evidence, retention, pinned-HTTPS, and scan-path verification are required before ordinary merge. No predecessor/base evidence transfers, force update, self-approval, or protection bypass is requested.

[coderabbitai]

Warning

Review limit reached

Next included review available in 23 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Team

Run ID: b84f9ebc-c9ed-4576-837e-3a927b3a0d24

📥 Commits

Reviewing files that changed from the base of the PR and between e71d37e and e8a6b7a.

📒 Files selected for processing (5)

• CHANGELOG.d/semantic-fixed-example-database-names.md
• examples/fixed-vibe-app/README.md
• examples/vulnerable-vibe-app/README.md
• tests/test_fixed_example_naming_contract.py
• tests/test_vulnerable_example_naming_contract.py

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}