Cases · App check
Access and subscription review of an app on Supabase and Stripe
A real, publicly available product, not a sample. The owners were told privately first, and this page names neither the app nor any single finding while the findings are open.
October 2026: owners contacted. The full report and patches follow once they reply.
The case
What was reviewed
A public web app on Supabase and Stripe. The review covered who may read and change what in the database, file storage and server functions, role by role; the Stripe subscription from checkout to the features of each plan; and the screens each role sees.
What the count leaves out
The count leaves out what the owners' own work had closed or covered at the last check.
How it was checked
Findings were reproduced on the owners' code, and the patched ones were checked again with the patches; where a point rests on the code alone, the report says so. The subscription findings were checked against Stripe's documented events and answers, not a live Stripe account. Each finding says what happened, what should have happened and where that expectation comes from: the app's own screens, texts, code and documentation, or common practice.
Result
102 findings: 13 high, 41 medium, 48 low. Patches are drafted for most of them: a first set gave the same results on the owners' own tests as their code did, and it will be rebuilt before it goes out. Some findings are left to the owners, because they need a decision only the owners can make. The owners were contacted privately in October 2026. If the owners agree once the fixes are live, this page will name the project and describe the fixed findings.
Findings by area
| Area | High | Medium | Low | Total |
|---|---|---|---|---|
| Subscription and payments | 4 | 2 | 5 | 11 |
| Data and server code, by role | 9 | 37 | 39 | 85 |
| Screens | — | 2 | 4 | 6 |
| Total | 13 | 41 | 48 | 102 |
Severity follows the consequence and how likely it is. Worth fixing here means critical, high or medium: in a polished app with real users, a medium finding can still reach them.
What kinds of defects
Most findings fall into a few patterns that are common in apps of this kind:
- Access wider than the role
- Subscription state that drifts from Stripe
- Features that silently do nothing
- Wrong money figures on screens
What goes to the owners
- A report with every finding: what happened, what should have happened and why, and where it is in the code.
- Patches for most findings on top of their latest code, with the order and the dependencies between them.
- Questions on the points only the owners can decide: their settings, their Stripe setup, their product choices.
- Known limitations of the patches themselves, and what the review did not cover.
Not a client job: the app was reviewed on my own initiative from its public code, without testing against the live site.
What a finding looks like
The findings of this app stay private while they are open. This is the same format, from the report on a sample shop.
Open the sample report (PDF)Any signed-in account can open any guest's order by its number
- AS RECEIVED
- The order page opens: name, street, city, email, phone, what was bought.
- AFTER THE FIX
- "We couldn't open this order."FIXED
- TEST
- A stranger's account asks for a guest's order. Failed before the fix, passes after.
Service
The same review for your app
You send the code or invite me read-only, not your passwords. Every finding comes with what happened, what should have happened and where it is in the code.