Hiding a button doesn't protect your admin page

Vibe-coded apps often decide who is an admin, or who has paid, inside the browser: the app checks a flag like isAdmin or isPro and hides a button when it's false. But anything in the browser can be changed by the visitor. Anyone can type the admin URL directly or flip that flag in their browser's developer tools.

The real check has to happen where the data lives.

The fix: ask your builder to enforce roles and paid features on the server. With Supabase, keep roles in a table users can't edit and write RLS policies that check it. In Vercel server routes, check the logged-in user's role before returning anything. Then log in as a normal user, open the admin URL yourself, and confirm you get nothing back.

Want an outside check of your live app? Run the free 15-second scan at leakyvibe.com.