Protected area guarded only in the browser
Scan rule · RSC-SEC-018
- Security
- Severity: High
- CWE-602
- OWASP A01-2021
Detects admin/account routes the client router knows while the guard lives purely as a condition in the bundle — anyone with the URL gets in.
Scan tier
- External scan (anonymous)
How to fix it
Enforce authorization server-side (middleware, server component, RLS) instead of client-side.