The AI-code failure catalogue

A key meant for the server ends up in JavaScript the browser downloads, so anyone can read it and call the service as the app.

The database's bypass-everything key is used in client code, so row-level rules no longer protect anything.

A key or token is in git history, where it stays readable to anyone with repository access even after the file changes.

A variable named with the framework's public prefix is inlined into the client, even though its value should have stayed private.

Test-mode payment keys, verbose logging or seed data run in production because the configuration was copied from development.

Responses ship without HSTS, content-type or frame policies, leaving the browser's built-in protections switched off.

A table created by a migration or SQL has no row-level security, so the anonymous key can read and write every row through the public API.

Row-level security is enabled but the policy condition is true for everyone, so isolation exists in name only.

A list or search endpoint filters by the wrong column or none, so a user sees records belonging to other accounts.

An endpoint checks that the caller is logged in, then returns whatever id was requested.

The admin page hides its buttons from ordinary users, but the underlying route or action accepts calls from anyone logged in.

The server decides what a user may do from a role, plan or isAdmin value that arrived in the request body, query string or client state.

The database or storage rules allow any client to read and write because the permissive development rules were never replaced.

The server sends the full database row to the browser and the UI shows a few fields; the rest, including other people's data, is in the payload.

A redirect in client code hides the page from signed-out users while the data endpoint behind it answers anyone.

The page checks the session, but the exported action it calls does not, and actions can be invoked by direct POST.

An endpoint in the sign-up or verification flow accepts calls out of order, so an account can be created or verified without the intended step.

Passwords and one-time codes can be guessed at machine speed because nothing counts attempts.

A form or endpoint changes data on a cookie-authenticated request without checking where the request came from.

Other devices stay signed in after the user logs out or changes their password.

Text a user typed is inserted into the page as HTML, so a script in a name or comment runs in other users' browsers and can take their session.

The endpoint that marks orders paid or plans active trusts any request that looks like an event.

The app hides premium features from free users while the API serves them to any caller.

The checkout call charges whatever amount the browser sent.

A delivered-twice event credits a customer twice or sends two emails.

The code expects subscription.created before invoice.paid, and leaves the account in the wrong state when they arrive reversed.

Nothing limits how many tokens one user, or the whole app, can consume, so a loop or a hostile user runs up the provider bill.

Text inside a document, message or web page the model reads changes what the model does.

A tool the model can call reads or writes data with the app's credentials instead of the user's.

Text from the model is inserted as HTML, used as a URL, or run as a command without validation.

Keys, internal URLs or other users' records are placed in the prompt and can be extracted by asking.

A provider upgrade or prompt edit changes outputs across the product and nobody measures it before release.

A slow or failing provider leaves the user on a spinner and may retry without bound.

A catch block logs nothing and returns a default, so a failed write looks like success to the user and to the team.

When a request fails, the loading flag is never cleared and the screen spins forever.

Error responses include internal paths, SQL or provider messages that help an attacker and confuse a user.

A failing call is retried immediately and indefinitely, turning one outage into a flood.

A hung third-party request holds the connection and the user until the platform kills it.

An empty list shows an error screen, or a failed query shows 'no items yet', and in an agent workflow an empty result is treated as a bug to fix.

A list page runs a separate query for each item, so response time grows with the data.

An endpoint returns every row in the table, which works in development and fails at the first real customer.

A new foreign key or filter column ships without an index, and queries slow down as the table grows.

A drop, truncate or rewrite runs against production without a restore having been tested.

Local runs, previews or agent sessions point at the production connection string.

The schema change cannot be undone, so a rollback of the release means restoring from backup.

Deleting a parent record silently removes children the product meant to keep.

Two simultaneous requests both read the old value and both succeed, so a balance goes negative or an item sells twice.

An agent session can run commands against production data or infrastructure without a human approval step.

Anyone with the CLI or a hosting token can deploy to production without review.

The team believes it can roll back but has not done it, and finds out the migration or the cache makes it slow or impossible.

A flag or variable exists in one environment and not the other, so a release passes in staging and fails in production.

The purchase code was only run against a mock, so restore, failed payment and receipt validation break on real devices.

The app assumes camera, location or notification permission was granted, and a denial leaves a blank screen or a crash.

The release runs on the developer's device and fails on the minimum supported OS version.

JavaScript changes go to every installed device through an OTA channel without the checks a store release gets.

Renewal, grace period, cancellation and refund leave the account in the wrong state because only the first purchase was ever exercised.