Auth and sessions
Protected route checked only in the browser
A redirect in client code hides the page from signed-out users while the data endpoint behind it answers anyone.
TermsAPI (the interface other software calls; tested directly, without the UI in between) · cross-site request forgery (another site making a user's browser send a state-changing request with the user's cookies) · cross-site scripting (user-typed text rendered as markup, so a script in a name or comment runs in other users' browsers) · two-user test (sign in as one user, create a row, then try to read or change it as another user; pass is nothing comes back)
criticalseverity if found in a releasesources verified 2026-09-21
Why AI-assisted code produces it
Client-side guards are what most tutorials show, and they satisfy a manual check. Server-side session verification has to be asked for explicitly.
An exported Server Action is reachable by direct POST request even when not used in the UI; a page-level authentication check does not extend to the Server Actions defined within it; environment variables prefixed NEXT_PUBLIC_ are exposed to the client.
Source: Next.js docs, 2026-08-25 · verified 2026-09-21
Five coding agents built 15 identical applications from the same prompts; the applications contained 69 vulnerabilities in total, every agent produced at least one server-side request forgery, none of the 15 applications had CSRF protection or security headers, and every login page shipped without rate limiting or account lockout.
Source: Tenzai, 2026-01 · verified 2026-09-21
How we detect it
Request each protected route and its data calls without cookies.
Most associated with
Tools: Cursor, GitHub Copilot, Claude Code, Windsurf, Lovable, Bolt
Checklist items that catch it
Every protected route verifies the session server-side
automated Request every route marked protected without cookies and with an expired session.
Every protected route returns 401, 403 or a redirect to login; none returns protected content.
Dots: Starter, Growth, Scale. The item runs on every release for the plans marked.
Check your codebase for this pattern
The coverage audit lists which catalogue patterns apply to your critical flows. 5 business days, $1,200, credited to a first month.