Fixes · Security holes

API routes and admin pages anyone can call

Routes and server actions that change data without checking who's signed in, and admin pages hidden only by not linking to them, are open to anyone who finds the address.

Most common in apps built with v0, Lovable, Bolt.

What you see

An /api route or server action writes to the database with no sign-in check, or /admin opens for anyone who types the address.

Why it happens

AI tools build the feature first; checking who's asking is a separate step that's easy to leave out, and nothing in a demo shows it's missing.

How to fix it

  1. At the top of every route and action that changes data, get the signed-in user and stop if there isn't one, or if they don't own what's being changed.
  2. Protect admin pages in a middleware or the admin layout, checking the user is an admin.
  3. Public forms (contact, waitlist) are fine without sign-in: give them a bot check instead.

Or ask your AI tool to fix it

Paste this into Lovable, Bolt, v0, Replit or Cursor, and let it make the change.

Add an authentication check to every API route and server action that writes data: get the signed-in user, return 401 if there's none and 403 if they don't own the record. Protect every /admin page with a check that the user is an admin, in middleware or the admin layout.

Don't change what the app does.
Never put a secret key or password in the code: read it from an environment variable.
If a step has to be done outside the code, like revoking a key in a provider's dashboard, list it for me at the end instead of skipping it.

How Launchpad helps

The launch check lists each route and action that writes without a sign-in check, and admin pages with none.

Check your app for this, freeJoin the waitlist

Related