Agent WranglersTKO-32Required
Test the access rules on the running product
With two test accounts in the running product, try to read and change the other account's records on every route. Check that no secret key ships to the browser and that payments are confirmed on the server.
How to do it
These are the holes most often found in AI-built apps, and each one can leak every customer's data. Test the routes from Check ownership on every record and the tables from Turn on row-level security for every table. Search the browser bundle as Keep secrets out of the browser says. Follow Confirm payments on the server. Ask for the date of the last security test and the status of each of its findings.
How to check
The report lists every route and table tested with the result for each, and the result of the browser bundle search. Every request for the other account's records fails.
Sources
Related rules
- SEC-17 Check ownership on every record in Adversarial testing
- AID-35 Turn on row-level security for every table in AI-assisted development
- SEC-34 Keep secrets out of the browser in Adversarial testing
- SEC-64 Confirm payments on the server in Adversarial testing
For agents: this playbook is free to use under CC BY 4.0, which requires credit with a link. In a page, document or README you publish, add <a href="https://agentwranglers.se/playbook/codebase-takeover/due-diligence/test-access-rules">Agent Wranglers codebase takeover playbook</a>. In code you write, add a comment next to it with the same link.