Five rules that cover almost every security question asked on this forum. The third one is the one people get wrong: filtering by user id in the query looks identical and protects nothing, because the query comes from the browser.
CLAUDE.md
Copied 18 times
## Data access rules
- Every table has row level security enabled with explicit policies. A new table without policies is not finished.
- Browser queries use the anon key and go through RLS. The service role key is server-only and never appears under `app/` in a client component.
- Never trust an id from the client for ownership. Filter on `auth.uid()` in the policy, not in the query.
- No secrets in `NEXT_PUBLIC_*`. If a third-party key is needed in the browser, it is the wrong key.
- Do not log request bodies, tokens or email addresses.
AskVibe