7 security bugs AI agents write in Next.js + Supabase + Stripe apps (and the rules that stop them)
RLS that protects nothing, service-role key leaks, unverified webhooks and more — with fixed code and an AGENTS.md rule for each.
🎯 Vulnerability: Web Security Vulnerability
💡 Defense Fix: Implement strict input validation, contextual output encoding, and enforce least-privilege authorization controls.