Ship it path Data and sign-in

Who is allowed to do this?

Find a permission that only the browser enforces and remove it, because anyone can change what runs in their own browser.

Start this module

Example brief

A club member list lets anyone tick "I am an admin" to reveal Delete all members. It looks like sign-in, but the visitor decides who they are.

An example. Use your own idea next.

Steps

Use the starting project: tick the admin box and see what appears. Who decided you are an admin?
Ask the AI to remove the browser-side admin switch and say that admin rights must be checked by a server.
Generate, then check the page no longer grants rights by itself and the member list still works.

What you will learn

Permissions: Rules about who may do what. They must be checked on a server, because anything in the browser can be edited by the visitor.
Authentication: Proving who someone is, usually with a sign-in. A checkbox that says you are an admin proves nothing.

A sample prompt

The page lets anyone tick I am an admin to show Delete all members. Admin rights should be decided by a server, not the page, so remove the admin checkbox and the delete-all button and say admin tools need a server. Keep the member form and list the same.

Write yours first, then compare.

To complete it

Pass all 9 checks and 2 behaviour tests on one version, then accept. You start from a working project and change it.