Example signUp() function leaks private information.

[k-thornton]

In the documentation, it specifies that signUp() intentionally returns fake user data in the event that someone tries signing up with an already confirmed email address.
https://supabase.com/docs/reference/javascript/auth-signup

Note that it only works this way if email + sms confirmations are set up.

This is presumably to prevent someone from going to your signup page and using it to deduce who your users are.

in this code:
https://github.com/vercel/nextjs-subscription-payments/blob/main/utils/auth-helpers/server.ts#L198
it seems to intentionally override this obfuscation, where the logic now leaks your users info.

I think the correct route would be to ignore this check and send the user the "please verify your email" success message regardless. At the very least, it's worth a comment here saying that it's something users may want to update as they go into production.