Suppose your app loads an invoice from a link ending in an id. If the server returns whatever record matches that id without checking that it belongs to the logged-in user, anyone can change the number and read other people's invoices. The id is not the problem; the missing ownership check is.
This is one of the most common flaws in AI-built apps, because generated endpoints often fetch by id and stop there. It hides easily: the app works perfectly for the developer, who only ever requests their own records. Switching to random ids makes guessing harder but does not fix it.
On every endpoint that takes an id, check on the server that the record belongs to the caller, or scope the query by user. With Supabase, do this through Row Level Security policies so the database enforces it even when application code forgets.
select * from invoices where id = $1 and user_id = $2;