LogicTrail
  • Trails
  • Check my app
  • Pricing
  • Sign in
  1. Trails
  2. /
  3. Who may see what
  4. · 4 minutes · Pro

The app id is not a password

Your company's internal HR app is 'private'. A stranger has just signed up and is reading salary data.

This answers: Can strangers sign up to my private app? No coding needed. 2 quick decisions.

  • Who is signed in
  • Who may see what

Checking your access…

Can strangers sign up to my private app?

If signup is open, yes. Ids in URLs, requests and JavaScript are visible to anyone, so they never protect anything. For private apps, turn off open signup and allow only invited users or approved email domains, enforced on the server.

Trail of the bug
  1. Stranger
  2. Auth service
  3. Database

Breaks at Auth service: Open signup on a 'private' app

Why AI tools write this bug

Builders often make apps 'private' by hiding links or relying on hard-to-find ids while the signup endpoint still accepts anyone.

How to fix it

  1. Turn off open signup for internal apps.

3 more steps, and a prompt that checks your own app for this bug. Part of Pro.

Unlock

Common questions

Is an unguessable id secure?
No. Ids leak through URLs, logs and code. Access must be checked by who the user is.

Related scenarios

  • Invoice 105Free · 4 min
  • The admin buttonPro · 4 min
  • Open it in incognitoPro · 4 min

More on this trail

Who may see what: Sign-in, permissions, and the leaks AI-built apps ship most often.

Want someone to look?

We check AI-built apps for this and three other common leaks, in plain English.

Check my app
Sign in

Sign in to walk this one

2 decisions, about 4 minutes, and a prompt to check your own app for the same problem.

Sign in No password. We email you a link.

How to fix it

  1. Turn off open signup for internal apps.

3 more steps, and a prompt that checks your own app for this bug. Part of Pro.

Unlock