The 10-minute checklist

0 of 6 checked

• 1. Are access rules on for every table with user data?

  Good sign: Access rules are on for every table with user data. Without them, anyone who finds your database can read it. See case 001 and 002.

  How: Open your database dashboard (Supabase: Authentication > Policies, Firebase: Firestore > Rules) and look for tables or rules that allow everyone.

• 2. Can signed-out visitors read private data?

  Good sign: Signed out, you can't read private data. Anything you can reach without logging in should be public on purpose.

  How: Open a private browser window, don't log in, and visit your app's pages and API links.

• 3. Does changing an ID open someone else's data?

  Good sign: Changing an ID doesn't open someone else's data. Being logged in proves who someone is, not what they own. See case 004.

  How: Make two test accounts. As account A, open one of your records, then change the number or ID in the address bar to one of B's.

• 4. Do your forms save only the fields users may change?

  Good sign: Forms only save the fields users may change. An extra field like role can slip into the request. See case 005.

  How: Ask your AI tool: which fields does my profile update endpoint accept? It should list only the ones users may edit.

• 5. Do prices, roles or permissions come from the browser?

  Good sign: Prices, roles and permissions never come from the browser. Anything the browser sends can be changed. See case 003 and 006.

  How: Ask your AI tool: where does the server get the price, the total and the user's role? The answer should be the database or server session, never the request.

• 6. Do reset links and tokens expire and work only once?

  Good sign: Reset links and tokens expire and only work once. An expiry date is just a number until the server checks it. See case 008.

  How: Request a password reset, use the link, then try the same link again. It should fail.