nextjs-16-architecture

No evidence of malware or intentional malicious behavior. The examples do show authorization concerns: delete and update lack visible authentication/ownership checks, and the create action's spread order may permit overriding the session-derived userId. These risks may be mitigated by checks in the data layer, which is not included here.