What AI coding models get wrong about better-auth

13 current findings across 33 models, verified against better-auth release notes. Latest better-auth at last verification: 1.7.3.

Where each model’s better-auth version attribution stops

ModelStated cutoffAttribution stops atLag
Claude Fable 52026-01 1.3.0 · 2025-07-19 ~6 months
Claude Fable 52026-01 1.3.0 · 2025-07-19 ~6 months
Claude Fable 52026-01 1.3.0 · 2025-07-19 ~6 months
Claude Fable 52026-01 1.3.0 · 2025-07-19 ~18 months
Claude Fable 52026-01 1.3.0 · 2025-07-19 ~18 months
Claude Fable 52026-01 1.3.0 · 2025-07-19 ~18 months
Claude Fable 52026-01 1.3.0 · 2025-07-19 ~6 months
Claude Fable 5.12026-06 1.3.0 · 2025-07-19 ~11 months
Claude Fable 5.12026-06 1.4.0 · 2025-11-22 ~7 months
Claude Fable 5.12026-06 1.3.0 · 2025-07-19 ~11 months
Claude Opus 52026-05 1.3.0 · 2025-07-19 ~10 months
Claude Opus 52026-05 1.3.0 · 2025-07-19 ~10 months
Claude Opus 52026-05 1.3.0 · 2025-07-19 ~10 months
Claude Opus 52026-05 1.3.0 · 2025-07-19 ~10 months
Claude Opus 52026-05 1.3.0 · 2025-07-19 ~10 months
Claude Opus 52026-05 1.2.0 · 2025-03-01 ~22 months
Claude Opus 52026-05 1.2.0 · 2025-03-01 ~22 months
Claude Opus 52026-05 1.2.0 · 2025-03-01 ~22 months
Claude Opus 52026-05 1.2.0 · 2025-03-01 ~22 months
Claude Opus 52026-05 1.2.0 · 2025-03-01 ~22 months
Claude Opus 52026-05 1.2.0 · 2025-03-01 ~22 months
Claude Opus 52026-05 1.2.0 · 2025-03-01 ~26 months
Claude Opus 52026-05 1.2.0 · 2025-03-01 ~26 months
Claude Sonnet 52026-01 1.0.0 · 2024-11-23 ~13 months
Claude Sonnet 52026-01 1.0.0 · 2024-11-23 ~13 months
Claude Sonnet 52026-01 1.2.0 · 2025-03-01 ~18 months
Claude Sonnet 52026-01 1.0.0 · 2024-11-23 ~13 months
Claude Sonnet 52026-01 1.1.0 · 2024-12-01 ~13 months
Claude Sonnet 52026-01 1.0.0 · 2024-11-23 ~14 months

Measured by asking each model what shipped in a given better-auth release, then checking the answer against the release timeline. Not inferred from the vendor’s cutoff date. This is the newest release the model can correctly place, not the newest better-auth feature it knows — a model past this point often uses a newer API correctly while naming the wrong release for it. Why that distinction matters.

Findings

Sorted by severity. “Chargeable” means the change was published before that model’s own stated cutoff, so the model had the opportunity to know it.

SeverityBeliefModelChanged inChargeableProof
S1breaks-build Invents an at-rest storage option on the phone-number plugin, and ships phoneNumber({ storeOTP: 'hashed' }) as the fix for the threat-model row
phoneNumber({ storeOTP })
Claude Opus 5 1.3.0
2025-07-19
yes source
S2silently-wrong Asked to flag anything to know before shipping bearer-token auth, says nothing about the plugin accepting unsigned tokens by default
bearer plugin
Claude Sonnet 5 1.1.0
2024-12-20
yes source
S2silently-wrong States that better-auth offers no stateless, store-free session mode, and names cookieCache, Redis and the jwt plugin as the only options
stateless / database-less sessions
Claude Fable 5 1.4.0
2025-11-22
yes source
S2silently-wrong States that operating with no server-side session state is not what the library supports, which stopped being true in 1.4.0
stateless session management
Claude Fable 5 1.4.0
2025-11-22
yes source
S2silently-wrong Denies that better-auth can run with no session store at all, and sends the reader to Redis or the jwt plugin instead
stateless / database-less sessions
Claude Opus 5 1.4.0
2025-11-22
yes source
S2silently-wrong Denies that better-auth can run with zero database, offering cookieCache and Redis instead
stateless / database-less sessions
Claude Sonnet 5 1.4.0
2025-11-22
yes source
S2silently-wrong States that better-auth cannot run without a database-backed session store, which stopped being true in 1.4.0
stateless session management
Claude Sonnet 5 1.4.0
2025-11-22
yes source
S2silently-wrong Denies that baseURL can be anything but a static string, and routes a multi-domain deployment through a canonical auth host instead
baseURL as a dynamic multi-host config
Claude Opus 5 1.5.0
2026-03-01
yes source
S2silently-wrong Predicts the freshness check passes for a 30-hour-old session that was used two minutes ago, and names updatedAt as the anchor — the pre-1.6.0 semantics, held consistently across two tasks
session.freshAge (measured from session.createdAt)
Claude Fable 5.1 1.6.0
2026-04-06
yes source
S2silently-wrong Denies the email-OTP plugin has a resend-reuse option and rebuilds it out of generateOTP plus a Redis cache — under storeOTP: 'hashed', which is the one configuration in which the real option refuses to reuse
emailOTP({ resendStrategy })
Claude Fable 5.1 1.6.0
2026-04-06
yes source
S2silently-wrong Denies the email-OTP plugin has a resend-reuse option and ships a Redis cache in front of generateOTP instead of resendStrategy: 'reuse'
emailOTP({ resendStrategy })
Claude Opus 5 1.6.0
2026-04-06
yes source
S3deprecated Denies the two-factor client plugin takes a page option, names twoFactorPage correctly, and dates it to the pre-1.0 releases as something since removed
twoFactorClient({ twoFactorPage })
Claude Fable 5.1 1.6.0
2026-04-06
yes source
S3deprecated Denies the two-factor client plugin takes a page option — while naming twoFactorPage correctly and asserting it was removed rather than added
twoFactorClient({ twoFactorPage })
Claude Opus 5 1.6.0
2026-04-06
yes source

Runs