Routes and server actions that change data without checking who's signed in, and admin pages hidden only by not linking to them, are open to anyone who finds the address.
What you see
An /api route or server action writes to the database with no sign-in check, or /admin opens for anyone who types the address.
Why it happens
AI tools build the feature first; checking who's asking is a separate step that's easy to leave out, and nothing in a demo shows it's missing.
How to fix it
- At the top of every route and action that changes data, get the signed-in user and stop if there isn't one, or if they don't own what's being changed.
- Protect admin pages in a middleware or the admin layout, checking the user is an admin.
- Public forms (contact, waitlist) are fine without sign-in: give them a bot check instead.
Or ask your AI tool to fix it
Paste this into Lovable, Bolt, v0, Replit or Cursor:
Add an authentication check to every API route and server action that writes data: get the signed-in user, return 401 if there's none and 403 if they don't own the record. Protect every /admin page with a check that the user is an admin, in middleware or the admin layout.
The full page, with the request ready to copy, is at launchpad.axonscape.com/fix/api-routes-anyone-can-call. I work on Launchpad by Axonscape, which runs a free launch check for apps built with AI tools: it finds this and the other things that break at launch, from a public GitHub repo or a .zip of the code, and keeps nothing.
Top comments (0)