The whole customer table, sent to the browser
Your UI shows one page of users. The API may have already sent every row. Open DevTools Network and the full table can be sitting in the response.
What can go wrong
Over-fetch here means the server returns an entire table (findMany(), select('*'), no filter by the signed-in user) and the frontend hides rows with JavaScript.
The browser already holds names, emails, and private messages. Dropping the auth header and replaying the same request often still works. This is row-level leakage, not changing one ID in the URL (that is IDOR).
GraphQL can mirror the same mistake: an anon key plus weak row rules can expose { usersCollection { edges { node { email } } } } even when your React list looks scoped.
It happened for real
In 2026, XDA Developers audited four real vibe-coded apps and found user-data leaks in three. Examples: a matchmaking site fetched every registered user on the homepage and filtered client-side ("the data was already on my machine"); a Lovable-built LinkedIn generator returned the platform's entire user database when the auth header was removed (XDA 2026).
Practitioner writeups call this "a server that returns all user data and trusts the client to filter it" (DEV bezael).
How to check yours
Seatbelt flags this automatically (partial). URL Ship Read can flag arrays of user records (multiple distinct emails) embedded in served page source. Repo scans catch bare model returns and some field-level over-fetch.
Honest holes: we do not yet statically prove every findMany() without a session-scoped where in your source. GraphQL over-fetch on a live URL is noted when we see the surface, not fully probed.
Ask your agent: "List every API route that returns user, profile, or order lists. Show the database query. Confirm each filters by the signed-in user's ID server-side."
Manual check: log in, open DevTools → Network, find list API calls, and read the JSON response. If you see more rows than the UI shows, the whole table shipped.
Fix direction
Filter in the database query (where: { userId: session.user.id }), paginate, and return DTOs with only display fields. Never rely on the frontend to hide rows you already sent.
Paste into your agent: "Audit list endpoints. Add server-side user scoping and field selection. Return 403 for cross-user access."