PhabricatorPolicyFilter has a bug right now where it lets through objects incorrectly if:

• the query requests two or more policies;
• the object satisfies at least one of those policies; and
• policy exceptions are not enabled.

This would be bad, but there's only one call in the codebase which satisfies all of these conditions, in the Maniphest batch editor. And it's moot anyway because edit operations get another policy check slightly later. So there is no policy/security impact from this flaw.

(The next diff relies on this behavior, which is how I caught it.)

• Added a failing unit test and made it pass.
• Grepped the codebase for requireCapabilities() and verified that there is no security impact. Basically, 99% of callsites use executeOne(), which throws anyway and moots the filtering.