Access-control bugs that only appear with a second user

No error. All tests pass. The bug exists from day one and becomes visible only when a second real user exists.

AI generators write queries that fetch by record id without also scoping to the owner. With a single test account every record belongs to you, so the missing ownership check is undetectable - the app is indistinguishable from a correct one. The corpus states it plainly: 'with one test account it all reads fine; with customers, the question is whether a logged-in shopper can open someone else's order.' Related to but distinct from RLS being off: here RLS may be enabled but the policy or query is scoped wrong.

Test with two accounts as a routine step, not an afterthought - log in as user B and request user A's record id directly. Enforce ownership in the database layer (RLS policy), not only in the query, so a missed check in application code cannot leak data.