Prompt: stop users reading each other's data
The most common serious bug in AI-built apps: /orders/1041 works, and so does /orders/1042.
Your frontend only ever requests the current user's records, so the bug is invisible in normal use. An attacker is not using your frontend — they change the number in the address bar. Being signed in is not the same as being allowed.
Copy this into Cursor, Claude Code, Lovable or your builder
Find and fix every place where a user can access another user's data
by changing an identifier.
1. List every route, API endpoint and database query that takes an id,
slug or similar identifier from the URL, the request body, or a query
parameter.
2. For each one, show me where it verifies that the identifier belongs to
the current user. If the only check is "is the user logged in", that is
the bug — mark it.
3. Add ownership enforcement in the query itself, not as a separate lookup:
select ... from orders where id = $1 and user_id = auth.uid()
so a mismatched id returns nothing rather than someone else's row.
4. Add the same rule as a Row Level Security policy, so it holds even if a
query is written elsewhere later.
5. Return 404, not 403, for records the caller does not own — a 403
confirms the record exists.
6. Do not rely on UUIDs being unguessable. That is obscurity, not access
control.
Give me a list of every endpoint checked, and what an authenticated user
gets when requesting an id belonging to someone else.What your AI should do with it
- Ownership folded into the query, not a separate check that can be skipped.
- The same rule duplicated at the database as a safety net.
- 404 rather than 403, so existence is not leaked.
How to check it worked
Two accounts, five minutes
- 1Create two test accounts, A and B.
- 2As A, open a record and note its ID from the URL.
- 3Sign in as B and request that exact URL.
- 4You should get nothing or a 404 — not A's record.
This is one check out of 40+
Paste your site address and we run the whole list from the outside — leaked keys, open databases, unprotected pages — then hand you one prompt that fixes what we find. Free, about 30 seconds, no signup.
Check my site — free