Authentication logic living entirely in the browser

What it is

Escape’s 2025 report notes Wiz Research identified common weaknesses in vibe-coded apps, including "misconfigured authentication (authentication logic living entirely in the browser)", excessive permissions and exposed secrets.

How to check

1. Log out, open DevTools → Network, and replay an admin or user-only request (Copy as cURL). If it still works, auth is client-side only.

How to fix

1. Enforce identity and role checks on the server (route handler, Edge Function) or in the database (RLS).

// Server route: verify the session, then the role, on every request
export async function GET(req: Request) {
  const user = await getUserFromSession(req);   // e.g. supabase.auth.getUser()
  if (!user) return new Response('Unauthorized', { status: 401 });
  if (user.role !== 'admin') return new Response('Forbidden', { status: 403 });
  return Response.json(await listAllOrders());
}

Sources

• Escape: State of Security of Vibe Coded Apps 2025 (PDF) ↗