LogicTrail
  • Trails
  • Check my app
  • Pricing
  • Sign in
  1. Trails
  2. /
  3. Don't trust the browser

Don't trust the browser

Everything the browser sends can be changed by the person using it: prices, quantities, plan names, file types, how many times a button is pressed. AI tools often build the happy path and trust it. This trail shows six ways that trust gets abused, and the server-side rule that fixes each.

Scenarios
6
Total time
24 minutes
Free to try
The first one

6 scenarios on this trail

  1. Next up · Free · 4 minThe $1 Pro planYour Pro plan costs $49 a year. Stripe shows three new Pro customers this morning who each paid $1.
  2. Stop 2 · Pro · 4 minThe webhook anyone could sendTwelve accounts upgraded to Pro overnight. Stripe shows no payments from any of them.
  3. Stop 3 · Pro · 4 minThe curious link previewYour app shows a preview card when someone pastes a link. A user pasted an odd address, and the preview showed your server's cloud credentials.
  4. Stop 4 · Pro · 4 minThe avatar that ran codeOne user's profile picture is a small grey circle. Everyone who opened it in a new tab was signed out, and their accounts were used elsewhere.
  5. Stop 5 · Pro · 4 minMinus three ticketsA customer bought minus three concert tickets. Your app 'charged' them -$60 and added $60 of store credit to their wallet.
  6. Stop 6 · Pro · 4 minOne coupon, fifty ordersYou posted a single-use 100%-off code for a launch giveaway. Within one second it was used for fifty free orders.

Other trails

  • Who may see what

    Sign-in, permissions, and the leaks AI-built apps ship most often.

  • The life of a click

    Follow one button press from the browser to the database and back.

  • Money and secrets

    Keys, payments, webhooks, and reading what your AI changed.

  • Data you can lose

    Agents that reset production, backups that are a day old, rollbacks that break.

  • Bills that explode

    Open AI endpoints, bot traffic, fake signups and functions that loop forever.

  • Working with your AI agent

    Dangerous commands, fix loops, deleted tests, prompt injection and invented packages.

  • Launch day

    Emails that never arrive, sign-in errors, timeouts, stale prices and connection limits.

  • Keeping it running

    Silent errors, empty AI credits, expired domains, leaky logs, risky updates and retired models.

  • Accounts and privacy

    Login codes, reset links, email changes, account deletion and customer data sent to AI.

  • Teams and sharing

    Removed members who keep access, invites anyone can use, exports that leak other customers, guessable share links.

  • Into the app stores

    Keys inside phone apps, store rejections, review sign-ins, old versions, deep links and over-the-air updates.

Sign in
  1. Next up · Free · 4 minThe $1 Pro planYour Pro plan costs $49 a year. Stripe shows three new Pro customers this morning who each paid $1.
  2. Stop 2 · Pro · 4 minThe webhook anyone could sendTwelve accounts upgraded to Pro overnight. Stripe shows no payments from any of them.
  3. Stop 3 · Pro · 4 minThe curious link previewYour app shows a preview card when someone pastes a link. A user pasted an odd address, and the preview showed your server's cloud credentials.
  4. Stop 4 · Pro · 4 minThe avatar that ran codeOne user's profile picture is a small grey circle. Everyone who opened it in a new tab was signed out, and their accounts were used elsewhere.
  5. Stop 5 · Pro · 4 minMinus three ticketsA customer bought minus three concert tickets. Your app 'charged' them -$60 and added $60 of store credit to their wallet.
  6. Stop 6 · Pro · 4 minOne coupon, fifty ordersYou posted a single-use 100%-off code for a launch giveaway. Within one second it was used for fifty free orders.