Fix · Security mistakes

My admin page can be opened without logging in

UrgentSecurity

What you may see

/admin or a dashboard opens for anyone with the link
The login only hides the buttons, but the data still loads

Most likely cause

Hiding a page or a button is not protection; the server must check who is asking on every admin page and every action.

Check first (about two minutes)

Open an admin address in a private window while logged out: do you see the page or data?
Try an admin action address directly while logged out (using a safe test record).

The fix prompt

What you type here never leaves your browser. The search runs on this page, and nothing is sent to a server or to an AI.

The exact error or what you see

What you did before it happened

Kept only in this browser, on this device. Keys and passwords are removed before anything is saved.

Prompt language

You are a calm senior security engineer who helps people who are not developers after they exposed a secret by mistake. I am not a developer, so explain every step in plain words and tell me exactly which button, menu or command you mean. If you are not sure about something, say so; do not guess.

This is urgent. Do the safety steps first, before anything else.

THE PROBLEM
My admin page can be opened without logging in

THE EXACT ERROR OR WHAT I SEE
[paste the exact error here]

WHAT I DID BEFORE IT HAPPENED
[write in a few words what you did before it happened]

MOST LIKELY CAUSE
Hiding a page or a button is not protection; the server must check who is asking on every admin page and every action.

DO THESE STEPS, IN THIS ORDER
1. List every admin page and every admin action (create, change, delete, export) and which check protects each on the SERVER.
2. Add a server-side check for a signed-in user with the right role on all of them (pages, API routes and server actions), refusing everything else.
3. Make the database rules (row level security) match, so a stolen link or key still cannot read private data.
4. Write tests that call each admin address logged out and as a normal user and expect a refusal.
Stop and tell me if what you see does not match a step. Do not skip ahead.

CHECK THAT IT WORKED
- Logged out and normal users get a refusal on every admin page and action, and admins still work.
Tell me exactly what I should see on the screen when it works.

DO NOT CHANGE
- Do not remove the admin features to fix this.
- Anything I did not ask about: the design, the text, other pages, other settings or the data.
- Do not delete files, data or branches, do not reset or force-push, and do not rewrite history, unless you first show me exactly what would be lost and I say yes.
- Do not paste, print or ask me to paste a password or secret key into this chat. If one is needed, tell me which settings page of the right service to store it in.

WHEN YOU FINISH
Explain in simple words what you changed (file by file or setting by setting), why you changed it, and how I can undo it.

Paste it into Claude, ChatGPT, Gemini or Cursor, then follow what it says.

After you tried it, did it work?

Steps

List every admin page and every admin action (create, change, delete, export) and which check protects each on the SERVER.
Add a server-side check for a signed-in user with the right role on all of them (pages, API routes and server actions), refusing everything else.
Make the database rules (row level security) match, so a stolen link or key still cannot read private data.
Write tests that call each admin address logged out and as a normal user and expect a refusal.

Do not do this

Do not use a secret address as protection.
Do not remove the admin features to fix this.

Try another entry