7 security bugs AI agents write in Next.js + Supabase + Stripe apps (and the rules that stop them)
AI coding agents are great at getting a Next.js + Supabase + Stripe app working . They're much less reliable at getting it safe . The bugs below all pass a quick click-through test, which is exactly why they ship. Every "fixed" snippet here is taken from a small reference app I built with Next.js 16, @supabase/ssr and the Stripe Node SDK, so you can copy them with some confidence. At the end…
We haven't written up this one. Dev.to has the full story — the link below goes straight to it.
