Platform
Cursor breaks
Cursor breaks: secrets in the client bundle, .cursorignore that does not stop the terminal, and rules in the generated app. For your own app.
21 cards are tagged Cursor. Symptoms in this set: Exposed data, Secrets, Auth, Payments, Over-open rules, Storage. Open a card for the root cause, the fix prompt, and the self-check. The check is only for an app you own.
Exposed data
Supabase tables ship with row level security off
The app looks correct while you are signed in. A request that carries only the publishable key, and no user session, can still read or write a table.
Exposed data
A policy uses USING (true) on private rows
Row level security is on, and the app still returns every row to any signed-in user, or to nobody at all.
Exposed data
Table grants stay wide open after policies are added
You added policies, then a signed-out client can still insert, or a signed-in client can still delete rows the policy was meant to hide.
Exposed data
A view bypasses row level security
The table policies look right. A view the app selects from still returns every row.
Secrets
The service role key is in the browser bundle
Data API calls from the site ignore every row policy. Searching the shipped JavaScript turns up a secret or service role key.
Secrets
A VITE_ variable bundles a secret into the client
An API key works in the browser preview. Anyone who opens the built JavaScript can read it.
Secrets
NEXT_PUBLIC_ inlines a secret at build time
A key was added as NEXT_PUBLIC_ so a client component could read it. The production bundle contains the value.
Secrets
A Client Component reads a server environment variable
The variable is not prefixed NEXT_PUBLIC_, but the secret still shows up in the HTML of a page that renders a Client Component.
Auth
An Edge Function turns auth off and never checks the caller
A function that changes data or spends money returns 200 with no session. It was set to verify_jwt = false, or auth: 'none', to clear a 401 during development.
Exposed data
The admin client returns every user's rows
The function checks that someone is signed in, then a query through the admin client returns the whole table.
Payments
The Stripe webhook accepts an unsigned body
A payment shows as paid, or a paid feature unlocks, when a request hits the webhook URL without a valid Stripe signature.
Over-open rules
Firebase rules allow every read and write
The app was created in Firebase Test mode, or the rules say allow read, write: if true. Anyone who knows the project can read and overwrite the data.
Over-open rules
Any signed-in Firebase user can read the whole database
Signed-out visitors are blocked. Any account, including one you just created, can read and write every document.
Over-open rules
A deeper Firebase rule cannot take access away
A child path sets ".read": false, and clients can still read it.
Auth
The app freezes after sign-in
Login returns, then the next Supabase call never comes back. The screen stays on a spinner.
Auth
OAuth comes back to the wrong host
Google or GitHub sign-in leaves the user on localhost, on a preview URL that errors, or on the site with an error in the URL hash.
Auth
Confirmation and reset emails point at localhost
Sign-up works in the builder preview. The email link opens localhost, or the production site never receives the token.
Storage
A public Storage bucket serves private files
A document or invoice URL loads in a private window, with no login.
Storage
Storage upload returns 403 even with an insert policy
Upload fails with 'new row violates row-level security policy' even though the insert policy looks correct and the user is signed in.
Auth
The UI hides a page, and the API does not
The admin screen is hidden unless a localStorage flag is set. The request that loads the data still succeeds without that flag.
Secrets
.cursorignore does not keep a secret from the agent
A .env file is listed in .cursorignore, and the agent still reads it through the terminal or an MCP tool.