The defaults nobody read
Security Misconfiguration

The attacker fingerprints the app, scrapes the Next.js build manifest, and lists every route the client knows about.

1. 1
   Find the extras

   Among the user-facing routes are /api/admin/users, /api/internal/queue, and /api/debug/env. None of them were meant to be public. All of them respond.
2. 2
   Walk the debug route

   /api/debug/env returns the process env as JSON. Inside: a Stripe live key, a Resend API key, the database URL, and the NextAuth secret.
3. 3
   Cross-origin the session

   The app allows Access-Control-Allow-Origin: * with credentials. The attacker hosts a page that fetches /api/me from the victim's browser and reads the session data — no XSS needed.
4. 4
   Log into the admin tool

   A scan of the box finds a Redis Commander on port 8081 with admin/admin. Full read and write on the session store.

None of these were bugs in the code. They were bugs in the config. Each one on its own would have been ugly. Together, they are a complete compromise of the app — and the code-review tool has nothing to say about any of them.

// app/api/_middleware.ts
export function middleware(req: Request) {
  const res = NextResponse.next();
  res.headers.set('Access-Control-Allow-Origin', '*');
  res.headers.set('Access-Control-Allow-Credentials', 'true');
  return res;
}

// app/api/admin/users/route.ts
export async function GET() {
  // "Internal only — nobody will call this from outside"
  return Response.json(await db.user.findMany());
}

// app/api/debug/env/route.ts
export async function GET() {
  return Response.json(process.env);
}

// app/api/_middleware.ts
const ALLOWED = new Set([
  'https://app.example.com',
  'https://www.example.com',
]);

export function middleware(req: Request) {
  const origin = req.headers.get('origin') ?? '';
  const res = NextResponse.next();
  if (ALLOWED.has(origin)) {
    res.headers.set('Access-Control-Allow-Origin', origin);
    res.headers.set('Access-Control-Allow-Credentials', 'true');
    res.headers.set('Vary', 'Origin');
  }
  return res;
}

// app/api/admin/users/route.ts
export async function GET(req: Request) {
  const session = await requireAdmin(req); // throws 403 otherwise
  return Response.json(await db.user.findMany());
}

// app/api/debug/env/route.ts — deleted in prod builds
export async function GET() {
  if (process.env.NODE_ENV === 'production') {
    return new Response('Not found', { status: 404 });
  }
  return Response.json({ env: 'dev only' });
}

Three rules. CORS is an allowlist of exact origins, never a wildcard with credentials. Every route on a public router requires auth — there is no such thing as 'internal only' on an endpoint anyone on the internet can reach. Debug endpoints do not exist in production builds. Delete them or gate them on NODE_ENV.