Your AI-built SaaS has login. But can User A access User B’s data?
Authentication working doesn’t mean your SaaS is secure.
One thing I keep seeing with AI-built apps:
The user logs in correctly.
Protected pages look protected.
Everything appears fine.
But the real question is:
Can User A access User B’s data?
For a multi-tenant SaaS, I think one of the simplest security tests is:
Create two accounts.
Then try to:
→ Read another user’s record
→ Change the record ID in a request
→ Update another user’s data
→ Delete it
→ Call an admin endpoint as a normal user
If any of those work, authentication wasn’t the real problem — authorization was.
This is one area I’m expanding while building VibeSafe.
For founders building with Supabase, Firebase, Lovable, Cursor, Bolt, etc.:
Do you actively test cross-user access before launching, or do you mostly trust your auth/database setup?
Honestly haven't tested this on my own tools beyond the obvious, mostly because they're stateless utilities without per-user data. But it's making me realize "no accounts" isn't the same as "no authorization surface", anything with a shareable link or an ID in a URL is worth the same two-account test.
That’s exactly it. Even when there are no traditional accounts, a shareable link, record ID, project ID, or public endpoint can still create an authorization boundary.
For VibeSafe, I’m thinking beyond “is login working?” and more about “can someone access, change, or delete something they were never supposed to touch?”
That kind of cross-user and ID-based testing is one of the areas I want to keep strengthening.