ok      Mail API key visible in the browser files
ok      Admin passcode visible in the browser files
PROBLEM Full mail key written in a project file (not counting .env)  (attack.py)
ok      .env file not ignored by git
ok      Admin export works without logging in  (HTTP 401)
ok      Admin delete-user route open without logging in  (HTTP 401)
ok      Logged-out visitor can read bookings  (0 bookings)
ok      Logged-out visitor can read contact messages  (HTTP 200, 0 messages)
PROBLEM A stranger can sign up through the API  (HTTP 200)
ok      Ben can read other customers' bookings  (0 not his)
ok      Ben can list other users (names, phones)  (0 others)
ok      Ben can make himself admin  (HTTP 404)
ok      Ben can create a booking in someone else's name  (HTTP 400)
ok      Booking with -5 walks, bad date, 4,000-char notes accepted  (HTTP 400 {"data":{"date":{"code":"validation_invalid_format","message":"Invalid value format."},"notes":{"code":"validation_max_t)
PROBLEM Booking dated 2026-02-31 (no such day) accepted  (HTTP 200)
ok      Contact form accepts 'not-an-email'  (HTTP 400)
ok      Error reply leaks stack trace or key  (HTTP 400)
ok      Front end shows 'Booked!' even when saving fails
ok      Notes inserted as raw HTML (script injection)
ok      30 wrong passwords in a row, never slowed down  (429s: 27)
ok      30 contact messages in a row, never slowed down  (429s: 28)

3 of 21 checks show a problem