A Lovable app shows another user's data
Being logged in is not the same as being allowed. A lot of generated apps load /projects/:id for any session. The second test user is how you notice.
Why this happens
- The query filters nothing except the id from the URL.
- Supabase RLS is off, so the anon client can read the row even when the UI hides the link.
- The team check was described in a prompt and never written.
What ShipWatch looks for
- ShipWatch logs in as test user A, collects private URLs, then logs in as test user B and opens them.
- If B can read A's sentences, the run fails and names the path.
Prompt to paste
A second logged-in user can open another user's record. On that route, require the session user id to match the row owner. Do the same with RLS. Return 404 otherwise. Add a test where user B requests user A's id and is denied.