The search endpoint interpolates the user-supplied q parameter directly into raw SQL with no sanitisation. An attacker can append arbitrary SQL and exfiltrate the entire database.

.env.local

A live third-party API key is committed in plaintext to .env.local which is tracked by git. Anyone with repository access — including public forks — can use this key to make authenticated API calls, incur charges, or access data on the account owner's behalf.

app/api/search/route.ts

The search endpoint interpolates the user-supplied `q` parameter directly into a raw SQL string without sanitisation or parameterisation. An attacker can terminate the query and append arbitrary SQL, enabling data exfiltration, row deletion, or privilege escalation.

app/api/admin/export/route.ts

The `/api/admin/export` endpoint returns a full CSV dump of the users table but never verifies that the caller holds an admin session. Any authenticated — or even unauthenticated — request can retrieve all user PII, including email addresses and hashed passwords.

lib/stripe.ts

The Stripe charge call is awaited inside a try block that catches the error and returns `null` silently. Downstream callers treat a `null` response as a successful charge, meaning failed payments are never surfaced to the user or logged for review.