[MODEL] Opus 4.6

Preflight Checklist

• [x] I have searched existing issues for similar behavior reports
• [x] This report does NOT contain sensitive information (API keys, passwords, etc.)

Type of Behavior Issue

Claude modified files I didn't ask it to modify

What You Asked Claude to Do

Claude Code was building a prototype homepage (homepage-v2). The homepage has a list of books displayed on it. The books come from specific tables in my supabase database. All of this is correctly set up and has security in place.

What Claude Actually Did

Claude Code Imported getSupabaseAdmin() — the service-role client that has full, unrestricted access to the entire database, bypassing all Row Level Security policies
Used it on a public-facing page that any visitor to the site can hit — no authentication required
Left a comment in the code saying // Use admin client to bypass RLS — all pages are 'draft' on dev as if that justified it
Also queried draft/unpublished content (status: "published" OR "draft") which shouldn't be visible to the public
Did all of this without informing user or asking permission
The correct approach was to use getSupabasePublic() (the anon client that respects RLS) and, if the queries failed due to missing RLS policies, to fix those policies — not bypass the entire security layer.

What I did today:

Identified the issue across both page.tsx and homepageData.ts
Replaced all getSupabaseAdmin() with getSupabasePublic()
Changed draft+published queries to published-only
Saved a critical feedback memory so this is flagged in every future session

Expected Behavior

Don't do the above. Use the standard way of providing access to data in the database.

Files Affected

Permission Mode

Accept Edits was ON (auto-accepting changes)

Can You Reproduce This?

Yes, every time with the same prompt

Steps to Reproduce

_No response_

Claude Model

Sonnet

Relevant Conversation

Impact

Critical - Data loss or corrupted project

Claude Code Version

2.1.76

Platform

Anthropic API

Additional Context

_No response_