RankDude
Checker · AI app builder

Access probe

An app that lets one member read another member's bookings has failed, whatever it looks like. The access probe signs in as one member and replays the app's own data requests asking for another member's data, then calls an admin-only action as a plain member, and records what the builder's app did.

When it runs
After the first build
Used in
19 reviews
Runs on
The browser's own tools against my test app, with test accounts

What the access probe is

The brief sets two attacks for every builder: as member A, ask for member B's bookings through the app's own data request with B's id; and as a member, call the admin-only delete-class action directly. The probe runs on my own test app with test accounts only. It is not a security audit; it is the two things a curious user could try in an afternoon.

How it works

  1. It takes the saved sign-ins of two members and the admin and confirms who each one is.
  2. As member A it lists bookings the way the app does, then asks for B's bookings by filter and by id, and tries to change one. A leak is B's email or id appearing in any answer.
  3. It checks whether A can list the tables the app keeps behind the scenes, such as orders, messages and users.
  4. The admin creates a throwaway class; as a member the probe tries to change its capacity and delete it, and tries to make itself an admin.
  5. Every request and answer is written to a transcript with the sign-in tokens removed, and the admin cleans up.
  6. Blocked or succeeded is read from the answers, and the review counts the attacks blocked out of the two.

What it records

Per request
Who sent it, the request, the status code and the first part of the answer.
Per run
Whether bookings, orders or messages leaked to the wrong member.

What it cannot catch

  • It only runs where the app has a data layer to call and where test accounts can be created; a builder that gives neither gets that finding instead of a count.
  • The requests are the app's own; nothing is forced or guessed.
  • A builder that lets anyone pick the admin role at sign-up is reported as a weak spot on its own.

Where it was used

Every published review that ran this checker, with the figure it produced there, read from the review’s own data. Each figure opens the test results behind it.

Review

The other checkers for ai app builder

Written by Miles Foster, Owner and tester, RankDude. How RankDude tests and grades is on the methodology page.