What is Browser?

Chrome, Safari and friends. Everything that runs here is visible to, and changeable by, the person using it.

Where Browser goes wrong in real apps

Each of these is a short scenario built from a real failure in an app made with AI. Read the answer here, or walk through it yourself in about four minutes.

Don't trust the browser · 4 minutes · Free
The $1 Pro plan
Your Pro plan costs $49 a year. Stripe shows three new Pro customers this morning who each paid $1.
Can users change the price at checkout?
Yes, if your server takes the amount or price ID from the browser. Anything the browser sends can be edited, so a visitor can create a checkout at any price. Send only which plan the visitor wants, and have the server look up the allowed price from its own list before creating the Stripe checkout.
Walk it, free
Money and secrets · 4 minutes · Free
The key in the bundle
Your OpenAI bill jumped from $40 to $3,900 overnight. Your app has 60 users.
Is my API key exposed in my frontend code?
If the key is in a variable with a public prefix such as NEXT_PUBLIC_, VITE_ or EXPO_PUBLIC_, or used in client code, it is in your JavaScript bundle and anyone can copy it. Revoke the key, create a new one, and call the paid API from your server only.
Walk it, free
Keeping it running · 4 minutes · Free
The error nobody saw
Sign-ups halved this week. No alert, no error on your screen. Then a customer writes: 'your form just says Something went wrong'.
Why don't I see errors my users see?
Many AI-built apps catch errors and show a generic message without recording the real error anywhere. Errors in the visitor's browser never reach your server logs on their own. Add an error tracking tool such as Sentry to both the browser and the server, with alerts, so you hear about failures before customers write in.
Walk it, free
The life of a click · 4 minutes · Pro
Blocked by CORS
Your API works in Postman. In the browser: 'blocked by CORS policy'. Your AI has 'fixed' the frontend three times.
How do I fix 'blocked by CORS policy'?
Fix it on the server that answers the request, not in your frontend. Browsers send a preflight OPTIONS request first; the API must reply with headers allowing your site's origin and the headers you use. Allow only your own origins rather than everyone, and remember CORS is not authentication.
Read the fix
The life of a click · 4 minutes · Pro
4am for a 10am booking
A customer in Chicago books a 10am appointment. Your confirmation email says 4am. The calendar page says 10am.
Why does my app show the wrong time?
The time was probably stored without a time zone, so the server and the browser each guess one. Store moments as timestamptz in Postgres (an exact moment, kept as UTC), store each user's time zone separately, and convert to local time only when displaying, using the same rule on server and browser.
Read the fix
Who may see what · 5 minutes · Pro
The table anyone can read
Your app uses Supabase straight from the browser. A stranger posts a screenshot of your whole users table on X.
Why can anyone read my Supabase table?
Your Supabase publishable (anon) key ships to every browser on purpose. Row Level Security decides which rows that key may read or change. If RLS is off on a table, or a policy uses (true), anyone can query every row. Turn RLS on and write policies around auth.uid().
Read the fix

Server: A computer that runs your app's code out of sight. Users can't change what happens there, which is why checks belong there.
Request: A message your browser (or any program) sends to a server asking for something: 'give me invoice 105' or 'save this profile'.
Database: Where your app keeps its data, organised in tables, like a set of spreadsheets.
API: The part of an app that other programs talk to. Your app's pages ask its API for data, like a waiter taking orders to a kitchen.
Table, row, column: A table is like one spreadsheet (orders). Each row is one item (one order); each column is one detail (price, date).
Secret key: A password your app uses to talk to a paid service. Anyone who sees it can use it, and spend your money.

All 62 terms in the glossary

Where Browser goes wrong in real apps

Each of these is a short scenario built from a real failure in an app made with AI. Read the answer here, or walk through it yourself in about four minutes.

Don't trust the browser · 4 minutes · Free

The $1 Pro plan

Your Pro plan costs $49 a year. Stripe shows three new Pro customers this morning who each paid $1.

Can users change the price at checkout?

Yes, if your server takes the amount or price ID from the browser. Anything the browser sends can be edited, so a visitor can create a checkout at any price. Send only which plan the visitor wants, and have the server look up the allowed price from its own list before creating the Stripe checkout.

Walk it, free

Money and secrets · 4 minutes · Free

The key in the bundle

Your OpenAI bill jumped from $40 to $3,900 overnight. Your app has 60 users.

Is my API key exposed in my frontend code?

If the key is in a variable with a public prefix such as NEXT_PUBLIC_, VITE_ or EXPO_PUBLIC_, or used in client code, it is in your JavaScript bundle and anyone can copy it. Revoke the key, create a new one, and call the paid API from your server only.

Walk it, free

Keeping it running · 4 minutes · Free

The error nobody saw

Sign-ups halved this week. No alert, no error on your screen. Then a customer writes: 'your form just says Something went wrong'.

Why don't I see errors my users see?

Many AI-built apps catch errors and show a generic message without recording the real error anywhere. Errors in the visitor's browser never reach your server logs on their own. Add an error tracking tool such as Sentry to both the browser and the server, with alerts, so you hear about failures before customers write in.

Walk it, free

The life of a click · 4 minutes · Pro

Blocked by CORS

Your API works in Postman. In the browser: 'blocked by CORS policy'. Your AI has 'fixed' the frontend three times.

How do I fix 'blocked by CORS policy'?

Fix it on the server that answers the request, not in your frontend. Browsers send a preflight OPTIONS request first; the API must reply with headers allowing your site's origin and the headers you use. Allow only your own origins rather than everyone, and remember CORS is not authentication.

Read the fix

The life of a click · 4 minutes · Pro

4am for a 10am booking

A customer in Chicago books a 10am appointment. Your confirmation email says 4am. The calendar page says 10am.

Why does my app show the wrong time?

The time was probably stored without a time zone, so the server and the browser each guess one. Store moments as timestamptz in Postgres (an exact moment, kept as UTC), store each user's time zone separately, and convert to local time only when displaying, using the same rule on server and browser.

Read the fix

Who may see what · 5 minutes · Pro

The table anyone can read

Your app uses Supabase straight from the browser. A stranger posts a screenshot of your whole users table on X.

Why can anyone read my Supabase table?

Your Supabase publishable (anon) key ships to every browser on purpose. Row Level Security decides which rows that key may read or change. If RLS is off on a table, or a policy uses (true), anyone can query every row. Turn RLS on and write policies around auth.uid().

Read the fix

Related terms

Server

A computer that runs your app's code out of sight. Users can't change what happens there, which is why checks belong there.

Request

A message your browser (or any program) sends to a server asking for something: 'give me invoice 105' or 'save this profile'.

Database

Where your app keeps its data, organised in tables, like a set of spreadsheets.

API

The part of an app that other programs talk to. Your app's pages ask its API for data, like a waiter taking orders to a kitchen.

Table, row, column

A table is like one spreadsheet (orders). Each row is one item (one order); each column is one detail (price, date).

Secret key

A password your app uses to talk to a paid service. Anyone who sees it can use it, and spend your money.