mediumOther people's data

Record Looked Up by ID Without an Owner Check

A record is fetched or changed by id alone; the signed-in user is not checked against it.

Why it matters

Your URL says /orders/123. A logged-in user changes it to /orders/124 and gets, or edits, someone else's order. The login check passed, so the server did what it was told. Every app with accounts has this shape somewhere, and it is where real data leaks come from.

What it looks like

This is the shape of code that triggers the rule. AI tools produce it because it works, and nothing tells them it is unsafe.

Prisma findUnique by params.id in an authenticated handler
export async function GET(req, { params }) {
  const session = await auth();
  const order = await prisma.order.findUnique({ where: { id: params.id } });
  return Response.json(order);
}

The smallest fix

minimal patch
// Add the owner to the lookup, so a wrong id returns nothing:
const order = await prisma.order.findFirst({
  where: { id: params.id, userId: session.user.id },
});
if (!order) return Response.json({ error: 'Not found' }, { status: 404 });

The better fix

If you have a few more minutes, this is the approach that holds up as the app grows.

safe alternative
// For shared resources (team documents), check membership instead:
const doc = await prisma.document.findFirst({
  where: { id: params.id, team: { members: { some: { userId: session.user.id } } } },
});

Let your AI tool fix it

When the scanner finds this in your project, it fills in the file and line for you. This is the prompt it gives you to paste into Claude Code, Cursor or whatever you use.

In [the file] at line [the line number], a record is looked up by id without checking that it belongs to the signed-in user: [the flagged code]. Add the user's id (or team membership) to the query condition so a record that is not theirs returns nothing, and return 404 in that case. Do this for the read, update and delete paths of this resource.

How to check the fix worked

1. Sign in as user A, request user B's record by id. Expect 404 or 403.
2. Request your own record. Expect it to load.
3. Try the same with the update and delete endpoints.

Further reading