security: CAPA privilege escalation, CSV injection, AI rate-limit, prompt injection guard, open redirect, timing-safe cron secret, server-only admin client, notifications RLS

2026-07-12 17:33:58 +08:00
parent c0ec6660ef
commit c80091c8d6
7 changed files with 49 additions and 6 deletions
@@ -1,3 +1,4 @@
+import 'server-only'
 import { createClient as createSupabaseClient, type SupabaseClient } from '@supabase/supabase-js'

 // Service-role client — bypasses RLS. Server-side only, and only for operations