Skip to content
ShipReady

Finding

Functions callable by name from the public schema

The public schema names {total} functions callable by name: {functions}. Whether each checks authorization needs a code review. ShipReady lists the names and never calls them, which is why backend rules stay on the not verified list.

Last updated September 20, 2026

Good to know · Needs a developer

Why AI-built apps get this

AI builders create tables in seconds and leave the access rules for later. The browser key is published in your app by design, so a table with no rule behind it answers anyone who copies that key. This is CVE-2025-48757 across 170 apps, and the Moltbook exposure, in one sentence.

What it affects

The public schema names {total} functions callable by name: {functions}. Whether each checks authorization needs a code review. ShipReady lists the names and never calls them, which is why backend rules stay on the not verified list.

What the evidence line looks like

table profiles answered the published browser key with 42 rows

Every finding on a result carries a line like this one: the request that was made and the answer that came back. You can run the same request yourself and get the same answer, which is the point.

The fix

Open each function and confirm it checks the caller before it does anything, or take it out of the public schema.

Prompt for your coding agent

Review every function exposed in the public schema, confirm each one checks the caller, and move the rest out of the public schema.

A result gives you this prompt written for your builder, in its own dialect, and a batch prompt that carries every fix at once.

Incidents that involved this

  • Not verified

    First-quarter 2026 assessment of 200 apps

    183 of 200 vibe-coded apps, 91.5 percent, contained at least one vulnerability traceable to AI hallucination or missing security context.

    2026-04
    Read the incident
  • Observed

    Moltbook records exposure

    An app exposed 4.75 million records, including 1.5 million API tokens and 35,000 email addresses.

    2026-01
    Read the incident
  • Not verified

    Tea app, first breach

    An unprotected storage instance exposed tens of thousands of user images, including identity documents.

    2025-07
    Read the incident
  • Not verified

    Tea app, second breach

    Three days after the first breach, over a million private messages were exposed through an API endpoint with no access control.

    2025-07
    Read the incident
  • Observed

    Lovable-built apps, CVE-2025-48757

    Broken access control reported across 170 production applications built with Lovable.

    2025-05
    Read the incident

Related terms

Run the free Launch Risk Check on your app

ShipReady is not a penetration test or a security certification. No automated check can prove an application is secure.

Last updated September 20, 2026