Server Actions with no auth
A Server Action is an HTTP endpoint with a generated URL, and hiding the button that calls it protects nothing. We add a session check and input validation to every action that reads or writes user data.
Fixed by Security hardening