Technical due diligence — Huurly

app/api/listings/[id]/route.ts (PATCH)
const user = await getUser();
await supabase.from('listings').update(body).eq('id', params.id);

The route checks login but does not constrain the update to the listing owner. If no lower-layer policy blocks it, another user could edit the listing.

Validate allowed fields, constrain the update to the owner, and verify database policies. Test an attempted cross-user update.

app/api/auth/login/route.ts — no local limiter around supabase.auth.signInWithPassword()

Repeated login attempts may reach the authentication provider without application-level throttling.

Verify provider limits; add appropriate throttling and abuse monitoring without locking out legitimate users.

supabase/migrations/0007_addresses.sql — CREATE TABLE customer_addresses (...)
No subsequent ENABLE ROW LEVEL SECURITY or policy found in supplied migrations.

Customer-address isolation cannot be established from the repository alone. Database grants, deployed settings and effective policies were not supplied.

Inspect deployed RLS status and grants. If missing, enable RLS and add owner-scoped policies in a migration. Test cross-user reads and writes.

supabase/migrations/0011_reviews.sql — CREATE POLICY "reviews_select" ON guest_reviews ...
No ENABLE statement found.

A policy existing in migrations does not establish that RLS is enabled in production.

Verify effective configuration and reproduce the required settings in migrations.

git log --all --full-history -- .env
Illustrative commit 3a1f9c2 — STRIPE_SECRET_KEY=sk_live_…

Deleting the file from the current tree does not remove historical access. The redacted sample is not a real credential.

Treat the real key as exposed: rotate it immediately, review usage and coordinate history cleanup. History cleanup alone does not revoke a key.

supabase/functions/send-confirmation/index.ts — service-role key used server-side

Future changes could accidentally move privileged logic into the client.

Document the trust boundary and add a regression check against client-side secret exposure.

app/api/inquiries/route.ts
await supabase.from('inquiries').insert(await req.json())

Unexpected fields and malformed values reach the database operation. Database constraints and grants were not verified.

Validate a bounded schema server-side, allowlist fields and reject unexpected values.

/api/inquiries and /api/listings/search — no application limiter found

Public endpoints may be susceptible to spam or scraping, depending on upstream controls.

Verify platform controls and apply shared request limits appropriate to each route.

app/api/webhooks/stripe/route.ts — checkout.session.completed processed without a unique event claim

Retries may process an order or grant entitlements twice. Duplicate charges are not established by this evidence.

Atomically claim the event, make business effects retry-safe, handle failures explicitly and test duplicate and concurrent deliveries.

components/CheckoutButton.tsx — no pending or disabled state during the checkout request

A rapid double click may create multiple sessions; it does not by itself prove a second payment.

Disable repeated UI actions while pending and enforce server-side idempotency for checkout creation.

app/api/listings/search/route.ts — a 184-line exported handler

Combined query, filtering and sorting logic makes changes and testing harder. Length alone is not a security finding.

Separate reusable query logic where it improves clarity and add behavior-focused tests.

app/(public)/listings/page.tsx
for (const listing of listings) {
  await supabase.from('profiles').select().eq('id', listing.owner_id);
}

Each listing adds a sequential database call, increasing latency as the result grows.

Use an appropriate join or batch lookup, then measure behavior with representative data.

app/api/inquiries/route.ts, app/api/bookings/route.ts and four other example routes — repeated email and phone expressions

Validation changes can diverge between routes.

Extract shared schemas and retain route-specific rules explicitly.

No supplied test exercises the Stripe webhook or checkout flow.

The duplicate-event behavior is not protected by a regression test.

Test a repeated Stripe event, concurrent deliveries and retry after a failed business operation.

No supplied test exercises ownership enforcement on app/api/listings/[id]/route.ts.

An authorization regression could go unnoticed.

Test that one user cannot update another user’s listing, including through database access paths.

vercel.json and .env.example — no separate staging project documented

The repository alone cannot establish whether isolated preview infrastructure exists.

Confirm deployment settings and document an isolated environment for payment and access-control testing.

package.json — no error-tracking integration found; handlers use console.error

Critical failures may be hard to detect and correlate. The absence of a specific dependency does not prove no monitoring exists.

Verify infrastructure monitoring and connect critical paths to alerting with request references.

app/api/bookings/route.ts
console.error('booking failed', body)

The example body includes guest email and phone details. Log access and retention were not supplied.

Log a request reference and sanitized error metadata instead of the full body.

See categories 01, 02, 05 and 09.

Ownership enforcement and duplicate payment-event handling require attention; effective database isolation remains unverified.

Fix the code paths, verify deployed database policies and add regression tests before a launch decision.