Security review notes

• Admin and dashboard routes require authenticated sessions; staff roles gate CMS.
• APIs validate payloads with Zod before mutating stores.
• Contact and review submissions never trust client-only checks alone.
• Payment checkout issues mock intents unless a provider secret is present.
• CSP/HSTS/XFO headers ship from next.config for production hardening.

Need more? Contact support.