Is checking that the user is signed in enough?

No. Also check that the record belongs to them, otherwise any signed-in user can change the ID in the URL and read someone else’s data.

All rules

SEC-019

API route returns data without authentication

HighDefault severity · Security · Secrets, HTTPS and security headers

Last reviewed 30 October 2026

An API route that returns user or account data without a session lets anyone read that data by calling the URL directly. Check the session at the start of every route handler, return 401 when there is none, and scope the database query to the signed-in user or organisation, not just to an ID from the request.

In apps built with AI tools

Agents build the page and the API together and test them while signed in, so a missing check never shows up. Hiding the link in the UI is often mistaken for protecting the route.

What it checks

Read-only GET requests (no cookies, no tokens) to API paths referenced by the site’s own JavaScript. Routes that look like they change data are never called.

Why it matters

If an API answers anonymous requests with user or account data, anyone can download it.

Recommended fix

Require a valid session on every API route that returns non-public data, and check the caller owns the record.

How to verify

Call the route with no cookies (for example curl -i) and confirm a 401; call it signed in and confirm it still works.

Example fix prompt

Generic prompt (your report adds the evidence)

Please fix this production issue in my app.

Issue SEC-019: API route returns data without authentication
Site: https://your-app.example

First confirm the issue in the code or live config. If it is not present, say so and change nothing.
Task: The API route(s) in the evidence return data to an anonymous request. For each route: check the session at the top of the handler and return 401 when missing, scope every query to the signed-in user or their organization, and return only the fields the UI needs.

Constraints: make the smallest change that fixes this, keep the current design and behaviour, never paste secret values into code or chat, and tell me which files you changed.
Done when: Call the route with no cookies (for example curl -i) and confirm a 401; call it signed in and confirm it still works.

Questions

Is checking that the user is signed in enough?: No. Also check that the record belongs to them, otherwise any signed-in user can change the ID in the URL and read someone else’s data.