FlutterFlow test data

I looked for sign-up, log-in and password reset for a member, an instructor and an admin on the live app, then tried the two attacks: a member asking for another member's bookings, and a member calling an admin-only action. I also recorded every network request the admin screen makes, and read the editor's Authentication setting.

There is nothing to log in to. The first screen asks which kind of user you are (Member, Instructor, Admin) and each button just opens that role's screens. In the editor, Authentication is switched off, and the Firebase page says no project is connected. I could not create the four test accounts or reset a password.

Both attacks had nothing to attack. The admin screen opens for any visitor who types its address, with no session, and the app makes no data request at all, only the page load. The delete button on a class does nothing. Every visitor sees the same made-up bookings, so one member can read what looks like another member's bookings without asking.

• Firebase Authentication was not set up, so what you would get with a backend connected was not tested.

The six data checks: the form and bookings write real records, they survive a reload, a republish and a design change, the admin can view, filter, edit and delete them, and they export as a file. I also opened the editor's Firestore and data type screens.

None of the six could be proved. The Firestore page reads No Collections Created and the Data Types page No Data Types Created. The Ask the studio form did nothing when I pressed Send Message, so no record was made. The CSV button did nothing. The sample members in the downloaded code are typed into it as text, for example Sarah Jenkins, and nothing is read from a database.

FlutterFlow does not host a database of its own for these apps. Data comes from Firebase or Supabase, which you connect. The AI did not connect either.

• A Firebase or Supabase backend was not connected, because that needs your own account.

The twelve scripted changes, one prompt each, on the live app.

I could not run the twelve changes as prompts. FlutterFlow's web editor has no chat that changes an app you already have. The command search (Ctrl K) offers Add Page with Designer and Add Component with Designer, which make a new screen from a description, and an AI Agent panel that needs the Windows desktop app and your own Claude or Codex login.

I tried the one change a new screen can answer, E04, an About page with the studio address, phone and email. It made the page in about 45 seconds and ignored the project: it wrote 123 Fashion Ave, Suite 400, Design District, NY, a phone number of +1 (555) 012-3456, the email hello@fittingroom.studio, a line calling Fitting Room a digital tailoring assistant and a version number, 2.4.0. None of it is in the brief, and the page is not linked from any screen. Because fewer than 8 of the 12 changes could run, the test is not graded.

• Making the other eleven changes by hand in the visual editor is possible but is not what this test measures.

The Fitting Room brief was pasted word for word (1,689 characters) into the Instant Generation box on the Projects page at 16:40 UTC on 26 October 2026. The clock stops when the app is live and the checks pass: 25 of 30 on the full scale, applied here as 20 of the 24 checks that need no keys of mine.

The first screens were in the editor about two minutes after I pressed send: nine pages, called Landing and Auth, Purchase Passes, Class Timetable, My Bookings, Instructor Dashboard, Admin Class Management, Admin Booking Export, Ask the Studio and Admin Inquiry Inbox, plus an Account Settings page. The project had Android and iOS switched on and web off, and one error: a Navigate action with no page chosen. Publish refused to run until I fixed that by hand.

I switched web on, chose a page for the action and pressed Publish at 16:50. The app answered at 16:52, 12 minutes after the brief, in 1 prompt and 2 hand fixes. It never reached 20 of the 24 checks: 2 passed.

• Both hand fixes were part of the 12 minutes.

The checks were run against the live app, by hand, with a note per check. The six checks that need your own Stripe and email keys (C24 to C29) are left out, so the thresholds are applied to the 24 that remain: 5 needs 93% or more (23 or more), 4 needs 80% (20), 3 needs 60% (15), 2 needs 33% (8) and 1 is below that.

2 of 24 checks passed, which is 8%. Passing: the timetable shows Reformer Basics, Mat Flow and Power Reformer with their days, times and durations (C05), and each class shows its instructor and a places-left line (C06).

The other 22 failed. There is no sign-up, log-in, log-out or reset (C01 to C04), pressing Book Class changes nothing (C07), and so My bookings, cancelling, the capacity rule, credits and the per-member rules (C08 to C12) do not exist. The instructor, admin and form screens look right but nothing on them works: Mark Present, Add Class, the edit and delete icons, Export all as CSV and Send Message all did nothing (C13 to C23). The day tabs at the top of the timetable do not switch either.

Nothing is saved, so the screens show sample data the AI made up: four members (Sarah Jenkins, Michael Chen, Emma Wilson and David Miller), 142 bookings, 38 this month, 22 total bookings, 84% capacity, 3 pending messages with example.com addresses, and 3 classes left on a member's balance. The timetable dates are fixed text (Monday, June 10), and the instructor screen says today is Monday May 15. So the app invents members, counts and messages (C30).

• Payments and the declined-card check were not run: they need your own Stripe key.

Publish to the free flutterflow.app address, timed, then three Lighthouse phone runs on the home page of https://fitting-room-0auira.flutterflow.app.

The Publish button on the Web Deployment page refused at first with a toast saying Fix errors in the project before publishing, and the generated project had web switched off. After the two fixes the app answered 2 minutes 12 seconds after I pressed Publish. The page carries a Built in FlutterFlow badge and a noindex tag, and the editor lists Allow Search Engine Indexing as off. The Basic plan includes one custom domain (the account page shows 1 available, 0 connected); I did not connect one.

The phone speed scores were 47, 48 and 42, median 47. The largest contentful paint was about 17.9 seconds, the page weighs about 3.2 MB, and the blocking time was between 0.8 and 1.4 seconds. Every page I opened ended in a blank white block under the content. A timetable with 100 seeded classes, layout faults at three widths and a real phone were not tested.

• Home page only; no domain; no layout fault count.

The Developer Menu in the editor, Download Code, on the Basic plan. I unpacked the file in a clean folder outside the repository and read it. I ran no build, because Flutter and Dart are not installed on my machine, and I ran no install script.

Download Code worked on Basic: a 425 KB file called fitting_room.zip with 178 files arrived in about 8 seconds. It is a standard Flutter project (lib, android, ios, web, assets, pubspec.yaml). The pubspec lists no Firebase, Supabase or FlutterFlow service package, because none was connected. A flutter_flow folder in the project holds the helper code FlutterFlow generates, in the open. Connect GitHub and Open in VS Code are marked as Growth features.

What the code holds is the front end only: the screens, with the sample names typed into them. There is no backend to run. Whether it builds I did not test. The terms were not read.

• Read, not built; licence terms not quoted.

One real question by email to support@flutterflow.io, sent at 00:42 UTC on 27 October 2026 (outside US business hours): which backend to add for sign-in and data, how to keep admin screens for admins, and how to export the data. I had also posted it in the community forum on 26 October, where it was still waiting for approval.

An automatic acknowledgement came after 30 seconds, and a full answer from FlutterFlow Support at 00:45, 3 minutes after I sent the question. It said Firebase is often simpler to start with for a small booking app and Supabase gives more control over permissions. For admin screens it described adding an isAdmin field and sending users to the admin page only when it is true, with links to the documentation. On export it said data is exported from the database provider, not from FlutterFlow, and gave no steps. It did not answer how to stop people choosing the admin role at sign-up.

Cancelling is self-serve on the account page, in four clicks. The plan then read Active until 26 November 2026 and the billing page showed no further charge. The only invoice, $33.97, matched the plan, the regional discount and the tax.

• The 7-day and 30-day checks on the app after cancelling cannot be done yet: the plan runs to 26 November 2026.

The pricing page, the account page and the invoice in Manage Billing were read on 26 October 2026. FlutterFlow shows no AI request counter.

I paid $33.97 for one month of Basic. The invoice reads Basic Plan $39.00, Regional 20% discount minus $7.80, Tax $2.77, total $33.97, so the pricing page showed $39 while the account page said $31 a month. On my first visit the pricing page itself showed $31.2; on later visits it showed $39. I do not know why it changed. I cancelled the plan when the testing ended: trash icon on the plan row, a confirmation saying the plan stays functional until 26 November 2026, a short survey (I chose No longer needed), then Plan canceled. The account then read Active until Nov 26, 2026 with a Reactivate Plan button, and the billing page read Your service will end on November 26, 2026 with no further charge. The only invoice is the $33.97 one.

The plan includes 50 AI requests a month and 100 Lite credits; Free has 5 AI requests for life and 10 Lite credits. I made 2 AI requests and cannot read the balance. The app does not work without a backend from Google (Firebase) or Supabase, and I did not price that part, so the running cost is unclear.

• Yearly prices were read, not bought. The AI request counter is not shown.