No hardcoded test users seeded at production startup

A seed script wired into postinstall or scripts.start runs on every production deployment and creates backdoor admin accounts with credentials that are publicly visible in your repository. Anyone who clones your repo — or reads your deploy logs — has the admin password. CWE-798 (Use of Hard-coded Credentials) and CWE-1188 (Insecure Default Initialization) both apply: the first deployment permanently plants known credentials in the live database, and subsequent deploys may re-upsert them if the seed is idempotent. Your security posture is now bounded by how broadly your repo can be read.

Move the seed command out of any lifecycle hook that runs in production (postinstall, start, build) and into an explicit dev-only script. In package.json:

{
  "scripts": {
    "seed:dev": "tsx prisma/seed.ts",
    "postinstall": "prisma generate"
  }
}

Run npm run seed:dev manually in development only — never in CI deploy pipelines. If your staging environment needs seed data, use environment-specific seeding gated by a SEED_DB=true env var that is never set in production. Audit prisma/seed.ts (or equivalent) and remove any user records with plaintext passwords or well-known test emails.