Open it in incognito
Everything works when you are signed in. A security researcher emails: 'Try your from a private window.'
This answers: How do I test my app for exposed data? No coding needed. 2 quick decisions.
- Who may see what
- Who is signed in
- Debugging without panic
Checking your access…
How do I test my app for exposed data?
Test every page and as four people: signed out, a normal user, a different user, and an admin. Any endpoint that returns data or makes changes for someone who should be refused is a security bug. Testing only while signed in as yourself hides these bugs.
Breaks at Your server: No sign-in check at all
How it works
What Maya's browser can readRow Level Security
| Order | Owner | Total | Maya sees it? |
|---|---|---|---|
| #1042 | Maya | £120 | Yes, hers |
| #1043 | Tom | £80 | Yes: leaked |
| #1044 | Ana | £215 | Yes: leaked |
| #1045 | Maya | £42 | Yes, hers |
Why AI tools write this bug
AI-built apps are usually tested by their creator, signed in, which is the one viewpoint from which missing checks are invisible.
How to fix it
- Open the app and its in a private window, signed out.
3 more steps, and a prompt that checks your own app for this bug. Part of Pro.
UnlockCommon questions
- What does a 200 response mean for a signed-out request?
- That the server returned data to an anonymous visitor. For private data, it should be 401 or 404.