Check that each person’s data stays private

Let’s do this

1. 1
   In your browser

   Make two test users

   Use two email addresses you control. Open account A in one browser and account B in a separate browser profile or private window. Add different sample plants to each. Each account should see only its own records if that is your intended design.

2. 2
   In your AI helper

   Test access at the data service

   Ask the AI to run checks using an unsigned visitor, account A and account B. A must not read, edit or delete B’s record by changing the record ID in a request. A must not create a row claiming B as its owner. For Supabase, test the database policies directly, not just the visible screens.

   Supabase: row level security (opens a new tab)
3. 3
   In your browser

   Test failed saves and lost connections

   Use the browser’s offline mode if available, or briefly disconnect Wi-Fi after the page loads. Try a save and then reconnect. The app should explain that saving failed and allow a safe retry. Reload afterwards and check that one item was saved, without duplicates.

4. 4
   In your AI helper

   Check the intended public routes too

   For the D1 tips example, unsigned visitors may read the public tips but must not have a write route. For any later private D1 feature, your function must verify the user and ownership on every request. D1 alone does not provide that policy layer.

5. 5
   In your AI helper

   Let people remove what belongs to them

   Ask for a clear delete-record action with appropriate confirmation. If offering account deletion, use a verified server flow to remove the account and deal with its records; do not put an administrative key in the browser. Test deletion with a disposable account and make the result clear.

   Supabase: public and secret keys (opens a new tab)