Does your app leak private data? Try this two-account test
App CheckControlled demo · fake data
Demo built and run 29 Sept 2026 · Published 1 Oct 2026 · Last reviewed 1 Oct 2026 · By Ctrl+Z Therapy (how we test)
The short answer
Two test accounts can show you. Log in as account one, open something private and copy the link. Open a private window, log in as account two and paste the same link. If account two can see it, any user can. A safe app shows an error instead.
What to do
- Make two test accounts.
- Log in as account one, open something private and copy the link.
- Open a private window and log in as account two.
- Paste the same link. Account two should get an error, not the data.
Good to know
- Do this on every page with private data.
How we checked it
We ran this in a demo app with fake data on 29 Sept 2026, and the video shows the result. Try it on your own app with test accounts and test data, never real users' data.