One field, a million credits
A free user now has 1,000,000 AI credits and the Pro plan. shows they never paid.
This answers: How do users give themselves a paid plan? No coding needed. 3 quick decisions.
- Who may see what
- Payments and webhooks
- Where your data lives
Checking your access…
How do users give themselves a paid plan?
If users may update their own row and that row also stores plan, credits or role, they can send those fields in a normal request. Keep anything that grants access or money in a table users can only read, change it from the server, and grant paid plans only from a verified payment event.
Breaks at Database: Users can write their own plan column
How it works
| Order | Owner | Total | Maya sees it? |
|---|---|---|---|
| #1042 | Maya | £120 | Yes, hers |
| #1043 | Tom | £80 | Yes: leaked |
| #1044 | Ana | £215 | Yes: leaked |
| #1045 | Maya | £42 | Yes, hers |
Why AI tools write this bug
AI tools often store plan and credits on the profile row and add a policy letting users update their own row, which unlocks every column at once.
How to fix it
- Move plan, credits and roles out of user-editable tables.
3 more steps, and a prompt that checks your own app for this bug. Part of Pro.
UnlockCommon questions
- Is hiding the field in the form enough?
- No. Requests can contain any field, whatever the form shows.