Guides

Most common mistakes

Last updated

These are the problems that show up most in apps built quickly or with an AI coding tool. Each one is easy to miss and easy to fix once you know it's there.

Keys and secrets

  • API keys in frontend code. Anything shipped to the browser can be read by anyone who opens the page, so a key there is a key for everyone. Exposed secrets →
  • The Supabase service-role key in the browser. It skips every database rule, so whoever finds it can read and change all of your data. Supabase service_role key →
  • Secrets committed to git history. Deleting a key from the code doesn't remove it from earlier commits, so it stays readable until you rotate it. Exposed secrets →

Who can see and change what

  • Supabase Row Level Security turned off. Without it, the public anon key can read or write every row in the table. Supabase RLS →
  • Admin routes without an auth check. Hiding the admin page isn't enough: anyone who calls the route directly gets what it does. Missing admin auth →
  • IDOR: changing an ID shows someone else's data. If the server doesn't check who owns a record, any signed-in user can open any record by guessing its ID. IDOR →
  • CORS that allows any origin with credentials. Any website your users visit can then make signed-in requests to your API and read the answers. CORS →

Money

  • Prices or totals trusted from the browser. A user can edit the request and pay whatever they like, so the server has to work out the amount itself. Client-side prices →

Limits, packages and settings

  • No rate limit on login or signup. Without one, a script can try thousands of passwords or create thousands of fake accounts. Rate limit checks →
  • Outdated packages with known vulnerabilities. Attackers look for apps running a version with a published hole, and the fix is usually an upgrade. Vulnerable dependencies →
  • Missing security headers. Headers like Content-Security-Policy and HSTS block whole classes of attacks for almost no effort. Header checks →
  • Verbose error messages. Stack traces and debug pages show attackers your file paths, versions and queries. Debug checks →

A Quick scan checks for all of these. Run one on your project to see which apply to you.