▶ quest log

AI Forgets Authorization: And That's a Security Hole

Coding Tools◆ Intermediate◆ Advanced@synsation_saved MAY 09

◇ Could this help me?

Yes: Critical general Claude Code practice. Always add an authorization prompt after building any feature that touches user data. Claude will set up auth flows but skips row-level security by default. Project-specific implementation varies but the habit applies everywhere.

✦ Walkthrough+10 xp / step

For every feature you build with AI: always explicitly ask 'Who has access to this feature?' and 'For someone who shouldn't have access, are they blocked?' Specifically prompt: 'Add authorization checks so users can only access their own data, not other users' records by changing IDs in the URL.'

0 / 1 steps · adopt for +40

$ suggested_prompt+40xp

Review this feature for authorization vulnerabilities. For every endpoint or data access point: confirm that users can only read/edit/delete their own records. A user should never be able to access another user's data by changing an ID in the URL or request. Add the necessary checks and explain what you added.

AI Forgets Authorization: And That's a Security Hole

More from Coding Tools

Write 3 Docs Before Building: Spec, Stack, and Lock Decisions

Auth Provider Picks: Better Auth for Control, WorkOS for Enterprise

A Full Stack Recommendation for Building With AI