https://shipreadyai.dev/learn/findings/o16-anonymous-signin

> Discover all available pages from the documentation index at https://shipreadyai.dev/llms.txt

# Anonymous sign in is turned on

The public auth settings at {endpoint} report anonymous sign in is on, so a caller can hold a session without ever giving an address. That is fine when it is deliberate and a problem when row rules assume a known person.

## Why AI-built apps get this

Backend sign in settings default to whatever gets a first account created fastest. Open signup and automatic confirmation are the defaults that make the demo work, and they are still the defaults on the day the product goes public.

## Evidence line

the public auth settings report mailer_autoconfirm: true

## The fix

Turn anonymous sign in off if the product does not use it, and check that no row rule treats an anonymous session as a known customer.

## Prompt

Turn off anonymous sign in unless the product needs it, and confirm no row rule treats an anonymous session as an identified user.