Find the cracks in your codebase. Before they break you.

// address revealed once the booking is 'approved' — that's the whole check
if (booking.status === 'approved') {
  return res.json({ address: listing.fullAddress }); // no ownership check
}

// limit keyed on a client-generated id — rotate it to bypass
const id = body.sessionId;            // crypto.randomUUID() on the client
await limit(`chat:${id}`, 20, '1h');  // no IP cap, no spend ceiling
const reply = await anthropic.messages.create(req);

// listing card — what the customer sees
const hourly = pricePerDay / 8;
// checkout — what the customer is charged
const total = (pricePerDay / 12) * hours;

// autoscale container — the filesystem is ephemeral
const db = new DatabaseSync('./data.db'); // no volume, no backup

// check and insert are not atomic — both approvals can win
const clash = await findConflict(listingId, dates);
if (!clash) await insertBooking(listingId, dates);