Critical handlers are not empty or return-only

An empty /api/auth/login handler returns success without verifying credentials, so any request authenticates anyone. An empty /api/webhooks/stripe handler 200s and drops the event, so Stripe stops retrying and payments never reconcile. These stubs map directly to OWASP A07 (Identification & Authentication Failures) and to silent revenue loss. AI scaffolds these endpoints early to keep routes compiling; the implementation gets deferred and forgotten.

Implement the actual logic for every auth, payment, and webhook handler before merging. Verify credentials, validate signatures, persist state, and emit structured errors on failure. Example for app/api/auth/login/route.ts:

export async function POST(req: Request) {
  const { email, password } = await req.json()
  const user = await verifyCredentials(email, password)
  if (!user) return Response.json({ error: 'Invalid credentials' }, { status: 401 })
  const session = await createSession(user.id)
  return Response.json({ session })
}