Security Review

A concrete, code-level security audit organized by real-world exploitability. Reviews the user's OWN codebase — never probe or attack systems the user does not own.

Audit checklist (OWASP-aligned, ordered by how often it actually bites)

1. Broken access control (the #1 real-world breach)

• Does EVERY endpoint/server action verify authentication AND authorization? Grep every route and check.
• IDOR: does GET /api/orders/:id verify the order belongs to the current user, or just fetch by id?
• Are role checks server-side? (Hiding a button in the UI is not access control.)
• Can a user escalate by sending role: "admin" in a body that gets spread into an update? (Mass assignment — whitelist fields.)

2. Secrets & data exposure

• .env committed? Keys in git history? (git log -p | grep -i "api[_-]key")
• Client bundle leaking secrets? Anything in NEXT_PUBLIC_*/VITE_* is PUBLIC — verify no service keys there.
• API responses over-returning: does the user object leak passwordHash, other users' emails, internal ids? Select explicit fields.
• Sensitive data in logs (passwords, tokens, PII, full card data)?