LogicTrail
  • Trails
  • Check my app
  • Pricing
  • Sign in
  1. Trails
  2. /
  3. Who may see what

Who may see what

Most data leaks in apps built with Lovable, Cursor or Claude Code are not hacks. They are missing permission checks: a record loaded by id without checking its owner, a Supabase table with Row Level Security off, an admin button hidden but not protected. This trail teaches you to spot all three.

Scenarios
10
Total time
41 minutes
Free to try
The first one

10 scenarios on this trail

  1. Next up · Free · 4 minInvoice 105Your invoicing app is live. A customer emails: they changed a number in the address bar and saw someone else's invoice.
  2. Stop 2 · Pro · 5 minThe table anyone can readYour app uses Supabase straight from the browser. A stranger posts a screenshot of your whole users table on X.
  3. Stop 3 · Pro · 4 minThe admin buttonOnly admins see the Refund button. A regular user has just refunded their own last three orders.
  4. Stop 4 · Pro · 4 minOne field, a million creditsA free user now has 1,000,000 AI credits and the Pro plan. Stripe shows they never paid.
  5. Stop 5 · Pro · 4 minThe bucket of ID photosUsers upload a photo of their ID to get verified. Someone on a forum just posted a link to one of them.
  6. Stop 6 · Pro · 4 minOpen it in incognitoEverything works when you are signed in. A security researcher emails: 'Try your API from a private window.'
  7. Stop 7 · Pro · 4 minThe redirect that let them inYour middleware sends signed-out visitors to the login page. A security advisory says one extra header can skip middleware entirely.
  8. Stop 8 · Pro · 4 minThe app id is not a passwordYour company's internal HR app is 'private'. A stranger has just signed up and is reading salary data.
  9. Stop 9 · Pro · 4 minDay 31: permission deniedYour app worked for a month. Today every read fails with 'permission denied'. Your AI has a one-line fix ready.
  10. Stop 10 · Pro · 4 minPermission denied for tableYour AI created a new 'invoices' table. Every page that reads it now fails, for every user, even you. RLS looks fine.

Other trails

  • The life of a click

    Follow one button press from the browser to the database and back.

  • Money and secrets

    Keys, payments, webhooks, and reading what your AI changed.

  • Data you can lose

    Agents that reset production, backups that are a day old, rollbacks that break.

  • Bills that explode

    Open AI endpoints, bot traffic, fake signups and functions that loop forever.

  • Working with your AI agent

    Dangerous commands, fix loops, deleted tests, prompt injection and invented packages.

  • Launch day

    Emails that never arrive, sign-in errors, timeouts, stale prices and connection limits.

Sign in
  1. Next up · Free · 4 minInvoice 105Your invoicing app is live. A customer emails: they changed a number in the address bar and saw someone else's invoice.
  2. Stop 2 · Pro · 5 minThe table anyone can readYour app uses Supabase straight from the browser. A stranger posts a screenshot of your whole users table on X.
  3. Stop 3 · Pro · 4 minThe admin buttonOnly admins see the Refund button. A regular user has just refunded their own last three orders.
  4. Stop 4 · Pro · 4 minOne field, a million creditsA free user now has 1,000,000 AI credits and the Pro plan. Stripe shows they never paid.
  5. Stop 5 · Pro · 4 minThe bucket of ID photosUsers upload a photo of their ID to get verified. Someone on a forum just posted a link to one of them.
  6. Stop 6 · Pro · 4 minOpen it in incognitoEverything works when you are signed in. A security researcher emails: 'Try your API from a private window.'
  7. Stop 7 · Pro · 4 minThe redirect that let them inYour middleware sends signed-out visitors to the login page. A security advisory says one extra header can skip middleware entirely.
  8. Stop 8 · Pro · 4 minThe app id is not a passwordYour company's internal HR app is 'private'. A stranger has just signed up and is reading salary data.
  9. Stop 9 · Pro · 4 minDay 31: permission deniedYour app worked for a month. Today every read fails with 'permission denied'. Your AI has a one-line fix ready.
  10. Stop 10 · Pro · 4 minPermission denied for tableYour AI created a new 'invoices' table. Every page that reads it now fails, for every user, even you. RLS looks fine.