Checks · AUTH-004

AUTH-004 · Email confirmation disabled with paid features

Why it matters

Anyone can create an account with someone else's address if confirmation is off, then reach paid features.

How we detect it

Auth settings show email confirmation disabled.

How we fix it

Turn confirmation on in the auth provider. This is a setting change, not a pull request.

Can it be fixed automatically? Instructions only

Related checks

• SEC-008 · Hard-coded admin email or password
• AUTH-001 · Admin route without auth check
• AUTH-002 · Authorization by client-side flag only
• AUTH-003 · Supabase user_metadata used for roles