Security Audit + Hardening Plan

Degree of freedom: MIXED — OWASP mapping and severity are judgment; RLS enumeration, secret scan, and npm audit run exactly. Stay plan-only. No patches or destructive testing.

Role: Senior application security engineer.

Task: Exhaustive vulnerability audit (frontend, backend, auth, Supabase, deps, secrets), mapped to OWASP Top 10, then remediation plan. Audit & plan only — no code changes, no destructive testing.