7 security bugs AI agents write in Next.js + Supabase + Stripe apps (and the rules that stop them)

说明与用途

AI 生成的 Next.js + Supabase + Stripe 应用常见安全漏洞。文章列出七种常见错误并给出修复规则，确保应用安全。

问题

AI coding agents often produce functional Next.js + Supabase + Stripe applications that pass basic tests but contain critical security flaws.

结果

Implementing the outlined rules transforms AI‑generated code from insecure to production‑ready, preventing data leaks, privilege escalation, and webhook abuse.

工作流

• Enable RLS on every public table and create ownership‑scoped policies.
• Replace any "using (true)" policies with user‑specific conditions.
• Use separate client instances: a per‑request user client and an admin client, marking the latter as server‑only.
• Validate server‑side sessions with supabase.auth.getUser() or getClaims() instead of getSession().
• In webhook handlers, read request.text() before parsing JSON and verify the Stripe signature first.
• Exclude webhook routes from auth middleware to avoid redirects.
• Store Stripe event IDs in a table with a primary key and skip processing if the ID already exists.

证据

Agents love to make an empty query go away by writing this: create policy "allow all" on public.subscriptions for select using (true);

来源

The admin client is only used in webhook handlers and background jobs, never in code that runs on behalf of a user.

来源

Webhook handlers read request.text() and verify the signature before touching the payload.

来源