Common Issues
auth
Users Can See or Do Things They Shouldn't
Your app doesn't properly control who can see or do what. Regular users might access admin pages, see other users' private data, or perform actions (like deleting or editing) that should be restricted.
Common Causes
- No role-based access control (RBAC) implemented
- Access checks only on the frontend — the API allows anything
- Row Level Security not configured (anyone can query any data)
- Admin routes are accessible by anyone who knows the URL
- User ID not validated on API calls — users can modify other users' data by changing the ID
How to Fix It
- Test by logging in as a regular user and navigating directly to admin URLs
- Check if API endpoints verify the user's role before performing actions
- If using Supabase, implement RLS policies that restrict data access by user ID
- Add server-side authorization checks — never rely only on hiding UI elements
- Verify that users can only read/update/delete their own data
Real developers can help you.
Matthew Jordan
I've been working at a large software company named Kainos for 2 years, and mainly specialise in Platform Engineering. I regularly enjoy working on software products outside of work, and I'm a huge fan of game development using Unity. I personally enjoy Python & C# in my spare time, but I also specialise in multiple different platform-related technologies from my day job.
Stanislav Prigodich
15+ years building iOS and web apps at startups and enterprise companies. I want to use that experience to help builders ship real products - when something breaks, I'm here to fix it.
Yovel Cohen
I got a lot of experience in building Long-horizon AI Agents in production, Backend apps that scale to millions of users and frontend knowledge as well.
legrab
I'll fill this later
Basel Issmail
’m a Senior Full-Stack Developer and Tech Lead with experience designing and building scalable web platforms. I work across the full development lifecycle, from translating business requirements into technical architecture to delivering reliable production systems.
My work focuses on modern web technologies, including TypeScript, Angular, Node.js, and cloud-based architectures. I enjoy solving complex technical problems and helping teams turn product ideas and prototypes into working platforms that can grow and scale.
In addition to development, I often collaborate closely with product managers, business analysts, designers, and QA teams to ensure that solutions align with both technical and business goals.
I enjoy working with startups and product teams where I can contribute both as a hands-on engineer and as a technical partner in designing and delivering impactful software.
MFox
Full-stack professional senior engineer (15+years). Extensive experience in software development, qa, and IP networking.
Anthony Akpan
Developer with 8 years of experience building softwares fro startups
ISHANTDEEP SINGH
Senior Software Engineer with 7+ years of experience in React, JavaScript, TypeScript, Next.js, and Node.js. I’ve also worked as a tech lead for startups, owning end-to-end technical execution including architecture, development, scaling, and delivery. I bring a strong mix of hands-on coding, product thinking, and technical leadership, and I’m comfortable building products from scratch as well as improving and scaling existing systems.
BurnHavoc
Been around fixing other peoples code for 20 years.
Daniel Vázquez
Software Engineer with over 10 years of experience on Startups, Government, big tech industry & consulting.
Describe what's wrong in plain English. No technical knowledge needed.
Get HelpFrequently Asked Questions
Users can access the admin page. Is this a big deal?
Yes. If the admin page has real functionality (delete users, change settings), this is a serious security issue. Get it fixed immediately.
How do I know if my app has permission issues?
Try logging in as a regular user and manually navigating to admin URLs. Also check if you can modify another user's data by changing IDs in API requests.