SAMPLE EVIDENCE for DX-06 (made-up app Tidyhaus; not a real review)

cancel_booking checks bookings.customer_id = auth.uid() before updating (function source excerpt).