LogicTrail
  • Trails
  • Check my app
  • Pricing
  • Sign in
  1. Trails
  2. /
  3. Who may see what
  4. · 4 minutes · Pro

Day 31: permission denied

Your app worked for a month. Today every read fails with 'permission denied'. Your AI has a one-line fix ready.

This answers: Why does Firebase deny access after 30 days? No coding needed. 2 quick decisions.

  • Who may see what
  • Supervising your AI

Checking your access…

Why does Firebase deny access after 30 days?

Test-mode rules allow anyone to read and write until a date, then expire. When they expire, every request is denied. Do not replace them with 'if true', which opens the database permanently. Write rules that let users access only their own documents, checked against request.auth.uid.

Trail of the bug
  1. Browser
  2. Database

Breaks at Database: Test rules expired; 'if true' opens all

How it works

What Maya's browser can readRow Level Security
OrderOwnerTotalMaya sees it?
#1042Maya£120Yes, hers
#1043Tom£80Yes: leaked
#1044Ana£215Yes: leaked
#1045Maya£42Yes, hers
With RLS off, any role granted access to the table, such as the public key, can read every row. Maya, or anyone with your site open, gets everyone's orders.

Why AI tools write this bug

AI tools often 'fix' permission errors by loosening the rules, which makes the error disappear along with all protection.

How to fix it

  1. Read your current rules and their dates.

3 more steps, and a prompt that checks your own app for this bug. Part of Pro.

Unlock

Common questions

Does request.auth != null protect user data?
Only from signed-out visitors. Any signed-in user could still read everyone's data. Check ownership.

Related scenarios

  • The fix that made it worsePro · 5 min
  • The ticket that gave ordersPro · 5 min
  • Invoice 105Free · 4 min

More on this trail

Who may see what: Sign-in, permissions, and the leaks AI-built apps ship most often.

Want someone to look?

We check AI-built apps for this and three other common leaks, in plain English.

Check my app
Sign in

Sign in to walk this one

2 decisions, about 4 minutes, and a prompt to check your own app for the same problem.

Sign in No password. We email you a link.

How to fix it

  1. Read your current rules and their dates.

3 more steps, and a prompt that checks your own app for this bug. Part of Pro.

Unlock