FinishKitFixes for AI-built apps
The production issues AI coding tools keep shipping, with detection steps and ready-to-copy fixes. Every finding links to the glossary and the blog posts that explain it in depth.
Security
Auth Check Only in Client Code
The auth gate runs only in a client component (a useEffect redirect or conditional render), so an attacker can bypass it by calling the API route directly.
IDOR Vulnerability on REST Endpoint
A REST endpoint returns resources by id without checking the caller owns them, so any signed-in user can read another user's data by changing the id.
Missing Row Level Security on Supabase Table
A public Supabase table has RLS disabled or an overly permissive policy, so any signed-in user can read or modify every row regardless of ownership.
Secret API Key Exposed in Client Bundle
A sensitive key (Stripe secret, OpenAI, Supabase service role) has a NEXT_PUBLIC_ prefix, so it is inlined into the browser bundle for anyone to read.
Unverified Stripe Webhook
The Stripe webhook endpoint accepts any POST without verifying the signature header, so an attacker can forge subscription events or credit accounts.
Missing Input Validation on API Route
A POST or PATCH route spreads the raw request body into a database write without checking that fields exist, have the right types, or are in range.
No Rate Limiting on Sensitive Endpoints
Authentication, OTP, password reset, and LLM proxy endpoints accept unlimited requests per user, enabling brute force, quota exhaustion, and runaway costs.
Missing Security Headers
The app ships no security response headers, leaving it open to clickjacking, mixed content, MIME sniffing, and cross-site scripting.
Open CORS Policy
An API route sets Access-Control-Allow-Origin to * on routes that accept credentials, letting any site call your API from a user's browser.
LLM Endpoint Vulnerable to Prompt Injection
A route sends user input to an LLM without separating it from system instructions, letting attackers override behavior, leak prompts, or trigger tools.
Stability
Missing Error Boundary
No error boundary exists, so a single component error unmounts the entire app and leaves users on a blank white screen with no recovery path.
Hydration Mismatch in SSR Component
A React component renders different markup on the server than on the client, usually because it reads time, randomness, or browser APIs on first render.