No in-memory data stores used as production databases

In-memory arrays as databases are the defining prototype artifact of AI-generated code. They work flawlessly in a single-process demo and fail completely the moment a second request hits a different process, the server restarts, or the platform auto-scales. Every write is silently discarded on restart — no error, no warning. Per CWE-1188 (Insecure Default Initialization), the defect is that the 'database' initializes to an empty slice of process memory rather than a durable store. Any data entered by real users — signups, orders, payments, messages — vanishes on the next deploy.

Replace the module-scope collection with a real database client. Even a local SQLite file persists across restarts. In src/lib/users.ts (or wherever the in-memory store lives), delete the array declaration and rewrite every read/write through Prisma, Drizzle, or your existing ORM:

// Remove this:
const users: User[] = []
export const addUser = (u: User) => users.push(u)
export const getUsers = () => users

// Replace with:
import { prisma } from '@/lib/db'
export const addUser = (u: User) => prisma.user.create({ data: u })
export const getUsers = () => prisma.user.findMany()

If you have no database yet, add prisma + @prisma/client, run prisma init, write a minimal schema for the collection, and prisma migrate dev.