What we found in your app's code

if (user.role !== 'admin') return <Navigate to='/' />

The admin data is protected only in src/pages/Admin.tsx. Add a check in the server function that returns the admin data: look up the signed-in user's role on the server, and return a 403 error unless it is admin. Keep the browser check as well.

const reply = await openai.chat.completions.create({ model, messages })

In api/chat.ts, before calling the AI, count how many chat messages the signed-in user has sent today and refuse with a friendly message once they reach 50. Store the count in the database, not in the browser.

if (reply.includes('DISCOUNT:')) await applyDiscount(user, code)

In api/chat.ts, remove the branch that applies a discount from the AI's reply. Discounts should only be applied at checkout from codes stored in the database.

const row = await db.from('resets').select().eq('token', token).single()

In api/reset-password.ts, refuse a reset token that is older than one hour or has already been used, and mark the token used as soon as the password changes.

In api/login.ts, count failed sign-ins per email and per IP address in the database. After 5 failures in 15 minutes, refuse further attempts for 15 minutes.

await supabase.storage.from('files').upload(path, file)

Add a storage policy for the files bucket that accepts only image/png, image/jpeg and application/pdf up to 10 MB. Add the same check in src/components/Upload.tsx so members see a clear message before uploading.

<div dangerouslySetInnerHTML={{ __html: reply }} />

In src/components/ChatBubble.tsx, stop using dangerouslySetInnerHTML. Render the reply as text, or pass it through DOMPurify first.

Update the image library in package.json to its latest version, run the install so package-lock.json changes with it, and check the upload and resize features still work.

List the people with access to this GitHub repository and remove anyone who no longer works on the app. Then add a rule that changes to main need one approval.

body: JSON.stringify({ amount: total })

In the server function that creates the Stripe payment, stop reading amount from the request. Look up the price of the product id on the server, apply any discount there, and charge that.

const event = JSON.parse(req.body)

In api/stripe-webhook.ts, verify each event with stripe.webhooks.constructEvent using the raw body and STRIPE_WEBHOOK_SECRET, and return 400 if it fails.

const client = new Client(process.env.DATABASE_URL)

In api/_db.ts, replace the new Client per request with a single shared pool using the database's pooled connection address, and make sure every request releases its connection, including when it fails.

Change src/components/Upload.tsx to upload files directly to Supabase Storage with a signed upload URL instead of through the server function, and show a clear message if the upload fails.

const { data } = await supabase.from('members').select('*')

In src/pages/Dashboard.tsx, load only the signed-in member's own row, and page through lists 50 rows at a time.