Access control and data isolation
Whole records passed to the client
The server sends the full database row to the browser and the UI shows a few fields; the rest, including other people's data, is in the payload.
Termsrow-level security (database rules that decide which rows each signed-in user may read or write) · two-user test (sign in as one user, create a row, then try to read or change it as another user; pass is nothing comes back) · publishable and secret keys (the publishable key may sit in the browser because row-level security limits it; the secret key bypasses those rules and must stay on the server) · API (the interface other software calls; tested directly, without the UI in between)
highseverity if found in a releasesources verified 2026-09-21
Why AI-assisted code produces it
Passing the object you already have is the natural completion. The Next.js guide names it as the main way private data leaks from server components and recommends data transfer objects.
An exported Server Action is reachable by direct POST request even when not used in the UI; a page-level authentication check does not extend to the Server Actions defined within it; environment variables prefixed NEXT_PUBLIC_ are exposed to the client.
Source: Next.js docs, 2026-08-25 · verified 2026-09-21
How we detect it
Read raw responses and the server-component payload for the most sensitive screens.
Most associated with
Tools: Cursor, GitHub Copilot, Claude Code, Windsurf, Lovable, Bolt
Checklist items that catch it
The client receives only the fields it renders
manual Inspect API responses and the server-component payload for the five most sensitive screens and list every field returned.
No password hash, token, internal note, other user's email or billing detail appears in any inspected payload.
Dots: Starter, Growth, Scale. The item runs on every release for the plans marked.
More in access control and data isolation
- critical
- critical
- critical
- critical
- critical
Check your codebase for this pattern
The coverage audit lists which catalogue patterns apply to your critical flows. 5 business days, $1,200, credited to a first month.