No hardcoded fake data returned from API handlers

Handlers that return hardcoded fake data silently lie to every caller. Users see a populated list named "John Doe" with email "john@example.com" and assume the product is wired up, so the defect escapes QA, reaches paying customers, and often surfaces only after launch when real accounts should exist. Marketing dashboards, onboarding flows, and integration partners all pull from the mock and make wrong decisions. The placeholder-hygiene taxon exists because these fabrications corrupt trust long before they trigger an observable error.

Replace every hardcoded return with a real data source in the same request path. Wire the handler to your database client, upstream SDK, or request body; gate any remaining mock behind NODE_ENV === 'development' so production fails loudly. Example fix in src/app/api/users/route.ts:

import { prisma } from '@/lib/db'
export async function GET() {
  const users = await prisma.user.findMany()
  return Response.json(users)
}