The database was open to every user.
Illustrative example- CriticalRow-level security disabled — any logged-in user could read every table.
- CriticalStripe secret key shipped in the client bundle.
- Warning/admin reachable with no session check.
Suggested fixes: enable RLS, move the secret server-side and protect admin routes.