Skip to content
ShipReady

Finding

Anonymous sign in is turned on

The public auth settings at {endpoint} report anonymous sign in is on, so a caller can hold a session without ever giving an address. That is fine when it is deliberate and a problem when row rules assume a known person.

Last updated September 20, 2026

Good to know · About ten minutes

Why AI-built apps get this

Backend sign in settings default to whatever gets a first account created fastest. Open signup and automatic confirmation are the defaults that make the demo work, and they are still the defaults on the day the product goes public.

What it affects

The public auth settings at {endpoint} report anonymous sign in is on, so a caller can hold a session without ever giving an address. That is fine when it is deliberate and a problem when row rules assume a known person.

What the evidence line looks like

the public auth settings report mailer_autoconfirm: true

Every finding on a result carries a line like this one: the request that was made and the answer that came back. You can run the same request yourself and get the same answer, which is the point.

The fix

Turn anonymous sign in off if the product does not use it, and check that no row rule treats an anonymous session as a known customer.

Prompt for your coding agent

Turn off anonymous sign in unless the product needs it, and confirm no row rule treats an anonymous session as an identified user.

A result gives you this prompt written for your builder, in its own dialect, and a batch prompt that carries every fix at once.

Incidents that involved this

  • Not verified

    First-quarter 2026 assessment of 200 apps

    183 of 200 vibe-coded apps, 91.5 percent, contained at least one vulnerability traceable to AI hallucination or missing security context.

    2026-04
    Read the incident
  • Not verified

    Tenzai study of AI-built apps

    69 vulnerabilities across 15 apps built by five AI coding tools.

    2026-02
    Read the incident
  • Not verified

    Tea app, second breach

    Three days after the first breach, over a million private messages were exposed through an API endpoint with no access control.

    2025-07
    Read the incident
  • Not verified

    Base44 authentication flaw

    A platform-wide authentication flaw allowed access to private enterprise data.

    2025-01
    Read the incident

Related terms

Run the free Launch Risk Check on your app

ShipReady is not a penetration test or a security certification. No automated check can prove an application is secure.

Last updated September 20, 2026