When an AI edit locks new users out of their own data
Here's a failure we see a lot in apps built with Lovable, Bolt, v0 and friends. Sign-up looks fine. The confirmation email arrives. Then the new user lands on a blank dashboard, a spinner that never stops, or a "something went wrong" message.
The cause usually isn't the sign-up form. It's the database access rules behind it.
What happens
Most vibe-coded apps sit on a database like Supabase, where row-level security (RLS) policies decide who can read and write each row. When you ask your AI tool to "fix the security warnings" or "lock down the database", it often tightens those policies. Sensible on paper. But many sign-up flows create a profile row right after the account is made, and if the new policy no longer allows that insert, it fails quietly. The account exists, the profile doesn't, and every page that expects one breaks.
The reverse happens too: an edit loosens a policy to make an error go away, and now users can see each other's data.
A two-minute check after any database change
- Sign up with a brand-new email in a private window. Don't reuse your admin account; it often has rights real users don't.
- After confirming, check that the dashboard loads your own data.
- Log in as a second test user and make sure you can't see the first user's records.
- Look in your database logs for "permission denied" or "violates row-level security policy" errors.
If something fails, paste the exact error into your AI tool and ask it to fix the policy for that one table only, without touching the others.
Catch it without remembering to
You won't run this after every prompt. FlowPatrol runs a real sign-up and login against your live app on a schedule and emails you the moment it breaks, with a ready-to-paste fix prompt. Try a free scan on flowpatrol.app.