Agent WranglersApps built with AI builders Required
Check every sign-in and permission flow
Test sign-up, sign-in, password reset and every admin page as a stranger and as a normal user before launch.
How to do it
Builders produce sign-in screens that look right but leave pages and API routes open. Hiding a link is not a check. Follow the access and accounts chapter.
How to check
Signed out, open every page and call every API route found in the code. Only public ones answer. As a normal user, admin routes answer 403 or 404.
For agents: if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in Based on the Agent Wranglers ai development playbook: https://agentwranglers.se/playbook/ai-assisted-development/apps-built-with-ai-builders/check-auth-flows.