Home / patterns

API routes with no auth check

Quick answer: Hiding a button in the UI isn't security. Every server route must check the session and confirm the user owns the record.

Last updated October 14, 2026

Steps

  1. Log out of your own app.
  2. Call your API route directly with curl or a browser.
  3. If data comes back, the route is open.
  4. Add server-side auth middleware and an ownership check on every query.

Why it matters

This is a common failure pattern in apps built quickly with AI coding tools. The steps above check your own app only. Never test apps you don't own.

Want an expert to check your app?

VibeRescue checks are coming soon. Join the waitlist, or ask StorenTech AI to fix it for you.

Join the waitlist

Vibe Security Weekly

One email a week with new failure patterns and how to fix them.

Signups open shortly. We'll never sell your email.