Review Authz, Session, And Secret Handling

What to inspect

• login, register, logout, refresh, and session routes
• role checks
• ownership checks on [id] routes
• password reset and recovery flows
• session creation, invalidation, rotation, and cookie flags
• JWT creation, signing, expiry, audience, issuer, and verification logic
• API key storage and response serialization
• plaintext secrets or default credentials in repo, docs, env examples, or logs

Questions to answer