Anonymous database access
Vibe-coded apps talk to their database from the browser using a public key. If the database is not locked down, a visitor does not even need an account. They can query your data directly, or in the worst case write to it, without ever using your app's interface.
What it looks like
The app has a login screen, so it feels protected. But the data layer answers requests that carry only the public key and no user session. Reads leak data. Writes let a stranger create, edit, or poison records.
Why it matters
Anonymous read is a data breach with no barrier at all. Anonymous write is worse: it lets anyone tamper with your app's contents, inject spam or malicious data, or corrupt records other users depend on.
How ArgosX detects it
ArgosX tests your data endpoints as an anonymous client and reports what comes back. Read probes run on every scan. Write probes are handled carefully and only where appropriate, because proving a write means touching your data.
How to fix it
Require authentication and authorization at the data layer, not just in the UI.
- Enable RLS (Supabase) or Security Rules (Firebase) so anonymous requests are denied by default.
- Grant read and write only to the specific users who should have it.
- Treat the public key as public: assume an attacker has it, and make your policies do the work.
Check your own app for this, free.
A free scan runs in minutes, no signup. Where it finds this, it proves it with the request and screenshot, not just a maybe. A human-verified pass is available when you want a person to confirm every finding.