Scan rule · RSC-SEC-018
Protected area guarded only in the browser
SecuritySeverity: HighCWE-602OWASP A01-2021
Detects admin/account routes the client router knows while the guard lives purely as a condition in the bundle — anyone with the URL gets in.
Scan tier
External scan (anonymous)
How to fix it
Enforce authorization server-side (middleware, server component, RLS) instead of client-side.