PROBLEM Mail API key visible in the browser files
PROBLEM Admin passcode visible in the browser files
PROBLEM Full mail key written in a project file (not counting .env)  (config.js, main.pb.js)
PROBLEM .env file not ignored by git
PROBLEM Admin export works without logging in  (HTTP 200)
PROBLEM Admin delete-user route open without logging in  (HTTP 404)
PROBLEM Logged-out visitor can read bookings  (3 bookings)
PROBLEM Logged-out visitor can read contact messages  (HTTP 200, 1 messages)
PROBLEM A stranger can sign up through the API  (HTTP 200)
PROBLEM Ben can read other customers' bookings  (2 not his)
PROBLEM Ben can list other users (names, phones)  (3 others)
PROBLEM Ben can make himself admin  (HTTP 200)
PROBLEM Ben can create a booking in someone else's name  (HTTP 200)
PROBLEM Booking with -5 walks, bad date, 4,000-char notes accepted  (HTTP 200 )
PROBLEM Booking dated 2026-02-31 (no such day) accepted  (HTTP 200)
PROBLEM Contact form accepts 'not-an-email'  (HTTP 200)
PROBLEM Error reply leaks stack trace or key  (HTTP 500)
PROBLEM Front end shows 'Booked!' even when saving fails
PROBLEM Notes inserted as raw HTML (script injection)
PROBLEM 30 wrong passwords in a row, never slowed down  (429s: 0)
PROBLEM 30 contact messages in a row, never slowed down  (429s: 0)

21 of 21 checks show a problem