Database table references exist in schema
Why it matters
A hallucinated table name is one of the clearest markers of AI-generated database code: the model invents a plausible name (userProfile, user_profiles) that differs from the actual schema (users, profiles). Prisma throws Cannot read property 'findMany' of undefined at runtime — a hard crash. Supabase returns a PostgREST 404 or an empty result set, which can silently suppress data that the application treats as authoritative. In both cases the failure mode is a runtime data-layer outage tied directly to reference-integrity drift (CWE-1188, OWASP A08: Software and Data Integrity Failures). The mismatch is undetectable at build time in Supabase projects unless type generation is wired into CI.
Severity rationale
Critical because a single unresolved table reference crashes the affected code path at runtime — Prisma hard-throws, Supabase silently returns no data — with no compile-time safety net in most stacks.
Remediation
Fix each hallucinated table name to exactly match the schema definition. Prisma model names are camelCase client accessors derived from PascalCase model names; Supabase table names are the literal CREATE TABLE identifier (typically snake_case).
// Prisma — model 'User' in schema.prisma → prisma.user (camelCase)
await prisma.userProfile.findMany() // Bad: 'userProfile' not in schema
await prisma.user.findMany() // Good
// Supabase — must match CREATE TABLE name in migrations exactly
await supabase.from('user_profiles').select('*') // Bad: table is 'profiles'
await supabase.from('profiles').select('*') // Good
For Supabase projects, run supabase gen types typescript --local > src/database.types.ts and use the generated Database type with the client to get compile-time table name checking.
DetectionPro
The detection method for this pattern is part of AuditBuffet Pro.
The full method (what to look for, pass and fail conditions, and how results get reported) ships inside the Hallucinated References Audit. The pattern definition, severity rationale, and remediation remain openly licensed under CC-BY-4.0.
External references
- cwe · CWE-1188 — Insecure Default Initialization of Resource: hallucinated table names default to runtime errors or empty data
- owasp:2021 · A08 — Software and Data Integrity Failures: data access layer calls resources that were never defined
Taxons
History
- 2026-04-18·v1.0.0·Initial import from ai-slop-hallucinations·automated
- 2026-04-20·v1.1.0·Add Phase 6.1 detect-node snippet for Prisma/Supabase schema vs .from() cross-reference·by cakleinman