Self-review: let your own AI check your code

1. Copy the prompt

Please review the code in this project for the security problems listed below. Read the files on this machine only; don't change anything, don't run the app and don't send code anywhere.

Checks:
1. secret-in-frontend: Secret API keys (Stripe sk_, OpenAI, service_role, AWS, private tokens) in code that runs in the browser, or in env vars with a public prefix (VITE_, NEXT_PUBLIC_, EXPO_PUBLIC_, REACT_APP_).
2. env-committed: Any .env file with real values tracked by git, or missing from .gitignore.
3. server-auth: API routes, server actions or edge functions that read or change user data without checking the signed-in user, or that trust a user id sent from the browser.
4. admin-hidden-only: Admin or paid features that are only hidden in the UI, with no check on the server or in database rules.
5. ai-route-open: Routes that call an AI provider without requiring sign-in or any rate limit, or AI provider calls made straight from the browser.
6. supabase-rls: Tables in the public schema (migrations or SQL) without RLS enabled, or with policies like using (true) on private data. This is the issue behind CVE-2025-48757.
7. supabase-service-role: The Supabase service_role or secret key used anywhere a browser can reach.

For each check, answer:
- fail: you found at least one case (count how many)
- pass: you looked and found none
- unsure: you couldn't tell from the code
- na: it doesn't apply to this project

First explain any fails to me in your own words, with the files involved, so I can fix them with you.
Then, at the very end, print this summary block exactly, with one line per check and nothing else inside it: no code, no file names, no keys, no comments.

SNIFFPUP-SELF-REVIEW v1
secret-in-frontend: <pass|fail|unsure|na> <count>
env-committed: <pass|fail|unsure|na> <count>
server-auth: <pass|fail|unsure|na> <count>
admin-hidden-only: <pass|fail|unsure|na> <count>
ai-route-open: <pass|fail|unsure|na> <count>
supabase-rls: <pass|fail|unsure|na> <count>
supabase-service-role: <pass|fail|unsure|na> <count>
END

2. Paste the summary block back

Only the lines between SNIFFPUP-SELF-REVIEW v1 and END are read. Anything else, including code, is ignored. It's read right here in your browser and never sent to us.