Objective
Your mission
Audit your app against 5 real-world failure patterns and fix any found. Output: failure_audit.md.
You need: A deployed (or near-deploy) app with Supabase.
Time: 25 minutes.
Step 1: learn the 5 failure patterns (5 min)
Every failure here happened to real people. Each was preventable with the habits from previous phases.
The common thread
Every failure in this lesson has the same root cause: the developer trusted the AI's output without reviewing it. The AI built functional code — features worked, UI looked good. But the AI didn't run security checks, didn't enable RLS on every table, didn't move secrets to env vars, didn't uncomment auth checks, didn't add error handling. These are human responsibilities. The AI is a code generator; you are the reviewer.
The 5 patterns:
- Exposed Database — RLS not enabled on a table → all data public
- Hardcoded Key — API key in source code → scraped by bots within hours
- Auth Bypass — Commented-out auth check → anyone can access protected pages
- Injection Vulnerability — Unsanitized user input in queries → SQL injection
- Silent Data Loss — No error check on DB operations → UI says "Saved!" but data is gone
Step 2: check pattern 1 — exposed database (3 min)
Go to Supabase Dashboard → Table Editor. Check EVERY table for RLS.
# Or check via SQL
SELECT tablename, rowsecurity FROM pg_tables WHERE schemaname = 'public';
Write in your file:
### Pattern 1: Exposed Database
Tables checked: [list all tables]
RLS enabled on all tables: [yes/no]
Tables missing RLS: [list or "none"]
Fix applied: [what you did]
Step 3: check pattern 2 — hardcoded key (3 min)
grep -r "sk_" src/
grep -r "eyJ" src/
grep -r "password" src/
grep -r "secret" src/
grep -r "key=" src/
Write in your file:
### Pattern 2: Hardcoded Key
Search results: [found keys or "none"]
Any real keys in code: [yes/no]
Fix applied: [moved to .env / N/A]
Step 4: check pattern 3 — auth bypass (2 min)
grep -r "// if (!user)" src/
grep -r "// auth" src/
grep -r "// protect" src/
grep -r "// Navigate" src/
Write in your file:
### Pattern 3: Auth Bypass
Commented-out auth checks found: [yes/no — where?]
Fix applied: [uncommented / N/A]
Step 5: check pattern 4 — injection vulnerability (3 min)
Look for any raw SQL or string concatenation in queries:
grep -r ".rpc(" src/
grep -r "raw sql" src/
grep -r "concat" src/
Supabase JS client uses parameterized queries by default — this pattern is rare with standard .from().select() calls. Check any rpc() or raw SQL.
Write in your file:
### Pattern 4: Injection Vulnerability
Raw SQL or rpc() calls found: [yes/no — where?]
User input sanitized: [yes/no/N/A]
Fix applied: [parameterized / N/A]
Step 6: check pattern 5 — silent data loss (5 min)
Search for database operations without error checks:
# Find all supabase operations
grep -r "supabase.from(" src/
grep -r "supabase.insert" src/
grep -r "supabase.update" src/
grep -r "supabase.delete" src/
For each found, verify it has const { data, error } and if (error) check.
Write in your file:
### Pattern 5: Silent Data Loss
DB operations found: [number]
Operations with error check: [number]
Operations missing error check: [list or "none"]
Fix applied: [added error checks / N/A]
Step 7: reflect on prevention (4 min)
Write in your file:
## Prevention Reflection
Which Phase 3 red flags would have caught these? [list]
Which Phase 7 checklist items would have caught these? [list]
Which Phase 8 security checklist items would have caught these? [list]
How do these habits compound? [1-2 sentences]
What root cause does the lesson find behind every real-world failure it lists?
The AI built features that worked; nobody checked RLS, secrets, auth checks or error handling. Those are the reviewer's job.