Access control and data isolation
Role or flag read from the request
The server decides what a user may do from a role, plan or isAdmin value that arrived in the request body, query string or client state.
Termsrow-level security (database rules that decide which rows each signed-in user may read or write) · two-user test (sign in as one user, create a row, then try to read or change it as another user; pass is nothing comes back) · publishable and secret keys (the publishable key may sit in the browser because row-level security limits it; the secret key bypasses those rules and must stay on the server) · API (the interface other software calls; tested directly, without the UI in between)
criticalseverity if found in a releasesources verified 2026-09-21
Why AI-assisted code produces it
The Next.js data security guide uses exactly this shape as its example of trusting searchParams. It is the shortest code that makes the feature work.
An exported Server Action is reachable by direct POST request even when not used in the UI; a page-level authentication check does not extend to the Server Actions defined within it; environment variables prefixed NEXT_PUBLIC_ are exposed to the client.
Source: Next.js docs, 2026-08-25 · verified 2026-09-21
How we detect it
Edit the role or flag in the request and repeat the call.
Most associated with
Tools: Cursor, GitHub Copilot, Claude Code, Windsurf, Lovable, Bolt
Checklist items that catch it
Admin functions are verified on the server
automated Call every admin route and admin server action as a regular user, with and without an admin flag set in the client state or query string.
Every admin route and action rejects the regular user regardless of client-side flags.
Dots: Starter, Growth, Scale. The item runs on every release for the plans marked.
More in access control and data isolation
- critical
- critical
- critical
- critical
- critical
Check your codebase for this pattern
The coverage audit lists which catalogue patterns apply to your critical flows. 5 business days, $1,200, credited to a first month.