7 security bugs AI agents write in Next.js + Supabase + Stripe apps (and the rules that stop them)

Description and use

AI‑generated Next.js + Supabase + Stripe apps frequently contain critical security flaws. The article lists seven common bugs and offers rules that fix them, making the applications secure.

Problem

AI coding agents often produce functional Next.js + Supabase + Stripe applications that pass basic tests but contain critical security flaws.

Outcome

Implementing the outlined rules transforms AI‑generated code from insecure to production‑ready, preventing data leaks, privilege escalation, and webhook abuse.

Workflow

• Enable RLS on every public table and create ownership‑scoped policies.
• Replace any "using (true)" policies with user‑specific conditions.
• Use separate client instances: a per‑request user client and an admin client, marking the latter as server‑only.
• Validate server‑side sessions with supabase.auth.getUser() or getClaims() instead of getSession().
• In webhook handlers, read request.text() before parsing JSON and verify the Stripe signature first.
• Exclude webhook routes from auth middleware to avoid redirects.
• Store Stripe event IDs in a table with a primary key and skip processing if the ID already exists.

Evidence

Agents love to make an empty query go away by writing this: create policy "allow all" on public.subscriptions for select using (true);

Source

The admin client is only used in webhook handlers and background jobs, never in code that runs on behalf of a user.

Source

Webhook handlers read request.text() and verify the signature before touching the payload.

Source