Checks · AUTH-002

AUTH-002 · Authorization by client-side flag only

Why it matters

A flag in the browser can be flipped by the visitor. It does not decide who the server will answer.

How we detect it

Access decisions read isAdmin from local storage or a client-only field.

How we fix it

Check the role on the server for every protected request.

Can it be fixed automatically? With review

Related checks

• SEC-008 · Hard-coded admin email or password
• AUTH-001 · Admin route without auth check
• AUTH-003 · Supabase user_metadata used for roles
• AUTH-004 · Email confirmation disabled with paid features