No fallback admin credentials in authentication code

Fallback admin credentials are a silent authentication backdoor. When a request arrives with an empty or malformed body, the OR-expression resolves to the hardcoded value — and the code proceeds to look up and authenticate a real admin account. An attacker who sends an empty POST to the login endpoint gets in as admin. This maps to OWASP A07:2021 (Identification and Authentication Failures) and CWE-1188 (Insecure Default Initialization): the default is not 'reject unauthenticated request' but 'log in as administrator.' No rate limit or firewall rule compensates for this; the bypass is baked into application logic.

Fail loudly on missing credentials at the route boundary — never fall through to a default email or password. In your login handler (src/app/api/login/route.ts or equivalent), replace every OR-fallback with explicit Zod validation:

import { z } from 'zod'

const LoginSchema = z.object({
  email: z.string().email(),
  password: z.string().min(1),
})

export async function POST(req: Request) {
  const body = await req.json()
  const parsed = LoginSchema.safeParse(body)
  if (!parsed.success) {
    return Response.json({ error: 'Invalid credentials' }, { status: 400 })
  }
  const { email, password } = parsed.data
  // No fallback, no default — explicit rejection only
}

Audit every file that reads req.body.email, req.body.password, or equivalent session fields and remove all || and ?? fallbacks to credential strings.