Other users seeing your data

1. Make the owner’s record.

   Sign in as account A and create a private test item. Open it and copy its direct page link if the app provides one. Keep the item’s id and expected owner in your notes.

2. Try the stranger’s view.

   Open an incognito window and sign in as account B. Paste the copied test-item link. Record whether you see the private text, an access refusal or an empty result. Do not test with a real stranger’s record.

3. Check the response as well as the screen.

   In B’s window, right-click, choose Inspect and select Network. Reload that item page. Inspect the data request’s Response. Private text returned by the server is exposed even when the interface hides it.

4. Compare the access decision.

   In the app’s backend or database settings, locate the read rule for this collection or route. Check whether it requires the signed-in user to own the requested record. If the app has no direct item link, stop here and ask for a controlled API test.

WORKSA can retrieve the test record and B receives no private record content.

BROKENThe backend returns A’s private content to B, whether or not the page displays it.

Ranked in the order to investigate, not by claimed frequency.

1. Only the interface filters private records.

   Enforce ownership on the server or in database access rules for every private read. A list filter in the browser cannot protect data already delivered to that browser.

2. The rule allows any signed-in user.

   Replace blanket signed-in access with the product’s actual ownership or membership condition. Verify A can still read the item and B cannot; denying everyone is not a complete repair.

3. Privileged credentials bypass user restrictions.

   Remove administrator credentials from the client and review every server route that uses them. Those routes must perform their own authorization before returning records.

• Shared workspaces need membership checks, not necessarily a single owner field. Write down the intended sharing rule before changing access.
• Rules that protect reads do not automatically prove writes and deletes are protected. Repeat those checks separately with disposable data after the read boundary is fixed.

When to stop and hand it over

Stop at the first confirmed cross-account disclosure and hand over the two test account ids, test record id and a redacted response. Restrict the affected feature while it is investigated. Do not continue exploring other users’ information.