A login screen is not an access control
Why we cannot test this for you without permission, and how to test it yourself.
The gap
Your login page protects the interface. It does not automatically protect the endpoints behind it. The common AI-built failure is a gated page in front of an ungated API: the screen asks you to sign in, and the data loads for anyone who calls the URL directly.
Test it in thirty seconds
Open your app, sign in, and copy a data endpoint URL from the network tab. Then paste it into a private browsing window where you are logged out.
If you see data instead of an error, that endpoint is not checking for a session. Repeat for each one — they usually fail as a group, because the missing check is the same missing check.
Why we do not just try it
Sending an unauthenticated request to your app to see what comes back is probing infrastructure. On a verified app we will do exactly that and report the result. On an app we have no proof you own, we will not — for anyone.
Not sure whether this applies to you?
Give us the address and we will tell you. No code, no access, no install — and every finding we have is shown in full, including on the free trial.
Check a site