Access control and data isolation
List endpoint returns other tenants' rows
A list or search endpoint filters by the wrong column or none, so a user sees records belonging to other accounts.
Termsrow-level security (database rules that decide which rows each signed-in user may read or write) · two-user test (sign in as one user, create a row, then try to read or change it as another user; pass is nothing comes back) · publishable and secret keys (the publishable key may sit in the browser because row-level security limits it; the secret key bypasses those rules and must stay on the server) · API (the interface other software calls; tested directly, without the UI in between)
criticalseverity if found in a releasesources verified 2026-09-21
Why AI-assisted code produces it
Filters are added per feature rather than enforced at the data layer; the 5,600-app scan found 175 exposures of personal data through app endpoints.
A scan of more than 5,600 publicly available applications built with prompt-to-app platforms found more than 2,000 vulnerabilities, over 400 exposed secrets, and 175 instances of exposed personal data.
Source: Escape, 2025-10-29 · verified 2026-09-21
CVE-2025-48757 (CVSS 9.3, critical): an insufficient database row-level security policy in Lovable through 2025-04-15 allowed remote unauthenticated attackers to read or write arbitrary database tables of generated sites.
Source: NIST National Vulnerability Database, 2025-05-30 · verified 2026-09-21
How we detect it
Create rows as user A, list as user B, for every list and search endpoint.
Most associated with
Tools: Cursor, GitHub Copilot, Claude Code, Windsurf, Lovable, Bolt
Checklist items that catch it
Policies deny cross-tenant reads and writes when tested as another user
automated For every table or collection, sign in as user A, create a row, then as user B attempt select, update and delete on it through the client API.
User B receives zero rows on select and a permission error on update and delete, for every table.
Dots: Starter, Growth, Scale. The item runs on every release for the plans marked.
More in access control and data isolation
- critical
- critical
- critical
- critical
- critical
Check your codebase for this pattern
The coverage audit lists which catalogue patterns apply to your critical flows. 5 business days, $1,200, credited to a first month.