Find your symptom.
Each case is a controlled demo with fake data: what you would notice, why it happens, how to fix it, and the same request run again to prove it.
Users can see each other's data
Anonymous visitor asksRLS: OFF
select id, email from profiles
200 OK · every email
anna@example.test
marc@example.test
lina@example.test
Data exposure · Case 001
Anyone could read every user's email
Anonymous request, every email returned.
match /{document=**} {
allow read, write: if true;
}
GET /users · no login
200 OK
Data exposure · Case 002
One rule let everyone read and write your data
No login, no token, and the demo users came back.
demo-notes.app/notes/2
Signed in as Alice
Bob's note
Private demo note. Owner: bob
Access control · Case 004
Changing one number opened someone else's note
Alice, logged in, reading Bob's note.
Someone became admin who shouldn't
People open pages they shouldn't
Prices or payments are wrong
Search returns weird results
Login or reset links act strange
Free diagnosis
+ fix help.
No repo neededPrivate by defaultNothing published without your OK