Access control and data isolation
Admin gate enforced only in the UI
The admin page hides its buttons from ordinary users, but the underlying route or action accepts calls from anyone logged in.
Termsrow-level security (database rules that decide which rows each signed-in user may read or write) · two-user test (sign in as one user, create a row, then try to read or change it as another user; pass is nothing comes back) · publishable and secret keys (the publishable key may sit in the browser because row-level security limits it; the secret key bypasses those rules and must stay on the server) · API (the interface other software calls; tested directly, without the UI in between)
criticalseverity if found in a releasesources verified 2026-09-21
Why AI-assisted code produces it
Next.js documents that a page-level authentication check does not extend to the server actions defined in it, and that actions are reachable by direct POST. Generated code tends to gate the page and stop.
An exported Server Action is reachable by direct POST request even when not used in the UI; a page-level authentication check does not extend to the Server Actions defined within it; environment variables prefixed NEXT_PUBLIC_ are exposed to the client.
Source: Next.js docs, 2026-08-25 · verified 2026-09-21
How we detect it
Call each admin action directly as a regular user.
Most associated with
Tools: Cursor, GitHub Copilot, Claude Code, Windsurf, Lovable, Bolt
Checklist items that catch it
Admin functions are verified on the server
automated Call every admin route and admin server action as a regular user, with and without an admin flag set in the client state or query string.
Every admin route and action rejects the regular user regardless of client-side flags.
Dots: Starter, Growth, Scale. The item runs on every release for the plans marked.
More in access control and data isolation
- critical
- critical
- critical
- critical
- critical
Check your codebase for this pattern
The coverage audit lists which catalogue patterns apply to your critical flows. 5 business days, $1,200, credited to a first month.