Can one customer see another customer’s data?
The most damaging leak in an AI-built app is not a stranger getting in. It is every customer being able to read every other customer’s data, with no attacker involved at all.
Free. No sign-up. We check the one page you give us, and only what any visitor can already see.
The free outside check finds data readable without any login. Seeing what one signed-in user can reach across another’s account needs you to prove the site is yours and switch on the deeper check, because it acts as a real user. We never change anything.
Nobody chooses this. It is what is left out.
It comes from one word. The rule that decides who may read a list can say "anyone signed in" or "only the person it belongs to", and the first one makes the app work immediately while the second takes thought. A tool asked to make the page load picks the one that makes the page load.
Nothing looks wrong afterwards. Each customer sees their own things, because the app only ever asks for their own things. The door is open, but nobody in normal use ever tries the handle. One curious person with a browser does.
This is also the hardest one to find from outside, because you have to be signed in to see it. The free check finds lists open to anybody at all; proving what one signed-in customer can reach across another’s account means acting as a real user, so we ask you to prove the site is yours first.
Two results, printed as you would get them.
Neither of these is your app. They are the words our own checker prints, on test apps we built with the faults we see in the wild.
Anyone who signs up to your app can read your "invoices" list in full. Not just their own entries, everyone’s.
We proved it: we made an account, and it could immediately read 1,847 invoices it had never created.
Every customer can read every other customer’s invoices.
Anyone who signs up to your app can read your whole "venues" list, all 42 of them.
That is probably fine for this one, but it is worth knowing it is not private.
Signed-in customers can see the whole venues list, which is likely intended.
One customer can see another. Now what?
The fix is the rule that ties each row to the person it belongs to, and it is a small change in one place per list. What makes it frightening is not the work, it is not knowing which lists are wrong, and whether it has already happened.
We cannot tell you whether somebody already looked; nobody can, unless your app kept a record. What we can do is show you exactly which lists are open, prove it by reading one, and give you the words to close them.
The questions people ask.
- You sign in to my app? With whose account?
- With one we create for the purpose, or one you give us, never a real customer’s. And only after you have proved the site is yours: we will not act as a user inside an app belonging to a stranger. On the free check we do not sign in at all.
- Do you read my customers’ actual data?
- We ask for it, because asking is the only way to prove the door is open, and then we keep almost none of it. A finding holds a count, the column names, and one sample row blanked past its first two characters. A screenshot has every word blanked before it is saved.
- Could you break something by doing this?
- No. Every one of these checks reads. None of them writes, changes or deletes, and the ones that would create anything in your app are off unless you switch them on yourself, on a screen that says exactly what they do.