Find your symptom.
Each case is a controlled demo with fake data: what you would notice, why it happens, how to fix it, and the same request run again to prove it.
Users can see each other's data
Anonymous visitor asksRLS: OFF
select id, email from profiles
200 OK · every email
anna@example.test
marc@example.test
lina@example.test
Data exposure · Case 001
Anyone could read every user's email
Anonymous request, every email returned.
match /{document=**} {
allow read, write: if true;
}
GET /users · no login
200 OK
Data exposure · Case 002
One rule let everyone read and write your data
No login, no token, and the demo users came back.
demo-notes.app/notes/2
Signed in as Alice
Bob's note
Private demo note. Owner: bob
Access control · Case 004
Changing one number opened someone else's note
Alice, logged in, reading Bob's note.
Demo Shop · signed in as bob
My profile
NameAlice Demo
Emailalice@demo.test
Address12 Demo Street
Data exposure · Case 011
Bob logged in and saw Alice's profile
Bob opened his profile. He got Alice's.
Someone became admin who shouldn't
People open pages they shouldn't
Signed in as: member
Admin report · hidden
GET /api/admin/report
200 OK
Access control · Case 003
The admin button was hidden. The admin data wasn't.
A regular member got the admin report: 200 OK.
Demo HR · signed in as sam (member)
Permission service timed out
Salariesmanagers only
Alice Demo$84,000
Bob Demo$91,500
Access control · Case 010
A crashed security check let everyone in
The check timed out. The page opened anyway.
Prices, payments or stock are wrong
Pro Plan$99.00
TOTAL CHARGED
$1.00
price sent by the browser
Payments · Case 006
A $99 item sold for $1
Price sent by the browser. Nobody checked it.
Demo app · credits
20 credits
You paid for 10
Payment · demo_001+10
Payment · demo_001 AGAIN+10
Payments · Case 009
One payment was credited twice
Same payment delivered twice. Credited twice.
Demo Store · Vintage camera · 1 in stock
aliceOrder confirmed
bobOrder confirmed
Stock-1 (2 orders)
Payments · Case 015
Two buyers bought the last item
One camera, two orders. Stock went to -1.
Search returns weird results
Login or reset links act strange
Data disappeared or didn't save
Demo Notes · the save failed
Trip plan
Saved ✓
Shown before the save finished
Data loss · Case 024
It said saved. The changes were gone.
The save failed. The message still said Saved.
Demo Notes · signed in as sam
Delete note 1
2 rows deleted · 0 left
Note 1deleted
Note 2deleted
Data loss · Case 017
Delete one note. Lose every note.
Deleted note 1. Both notes were gone.
Demo app · last night's backup
backup.json · exists · not empty
Health checkHealthy
RestoreFailed
Data loss · Case 021
The backup said healthy. It wouldn't restore.
Health check said healthy. The restore failed.
Passwords or keys show up in logs
Free diagnosis
+ fix help.
No repo neededPrivate by defaultNothing published without your OK