IDOR risk: user_id from request body used in Supabase query without JWT verification

What it is

user_id is read from the request body and used as a query filter without verifying it against the caller's JWT.

Why it matters

The client chose that value. Any authenticated user can substitute someone else's id and read or modify their rows — a straightforward IDOR that returns 200 and logs as normal traffic.

How to fix it

Derive the identity server-side: const { data: { user } } = await supabase.auth.getUser(), then filter on user.id. Never accept an identity field from the request body.