security: CAPA privilege escalation, CSV injection, AI rate-limit, prompt injection guard, open redirect, timing-safe cron secret, server-only admin client, notifications RLS

lib/csv.ts

@@ -1,6 +1,8 @@
 export function escapeCsv(value: string | number | null | undefined): string {
   if (value === null || value === undefined) return ''
-  const str = String(value)
+  let str = String(value)
+  // Prevent CSV formula injection (Excel/LibreOffice execute cells starting with these chars)
+  if (/^[=+\-@\t\r]/.test(str)) str = "'" + str
   if (str.includes(',') || str.includes('"') || str.includes('\n')) {
     return `"${str.replace(/"/g, '""')}"`
   }

lib/supabase/admin.ts

@@ -1,3 +1,4 @@
+import 'server-only'
 import { createClient as createSupabaseClient, type SupabaseClient } from '@supabase/supabase-js'
 
 // Service-role client — bypasses RLS. Server-side only, and only for operations