Pre-launch security review for a vibe-coded app

Review this codebase for launch-blocking security issues. Report findings first; don't fix anything until I approve.

Check specifically:
1. Secrets in client code, in git history, or in env vars with a public prefix (NEXT_PUBLIC_, VITE_, EXPO_PUBLIC_).
2. Database access rules: Supabase RLS enabled on every exposed table with sensible policies / Firebase rules not open to everyone.
3. Every API route: does it check the user is signed in and allowed to touch that specific record?
4. Server endpoints that call paid APIs (LLMs, email, SMS): auth + rate limiting + input size limits.
5. Payment webhooks verify signatures.
6. User input rendered as HTML (dangerouslySetInnerHTML, innerHTML) or used in SQL.
7. CORS settings that allow any origin with credentials.
8. Admin pages protected on the server, not just hidden in the UI.

Output a table: issue, file:line, severity (high/medium/low), suggested fix.