Checks · AUTH-001

AUTH-001 · Admin route without auth check

Why it matters

An admin page that loads without a signed-in session is open to anyone who knows the address.

How we detect it

Route files under /admin lack a server check, and a single unauthenticated request returns the page.

How we fix it

Add a server-side guard and redirect signed-out visitors.

Can it be fixed automatically? With review

Related checks

• SEC-008 · Hard-coded admin email or password
• AUTH-002 · Authorization by client-side flag only
• AUTH-003 · Supabase user_metadata used for roles
• AUTH-004 · Email confirmation disabled with paid features