New submissions enter moderation queue and are not visible until approved

A directory without a moderation queue is an open invitation for spam, defamatory content, and phishing links — all published the instant a form is submitted. Every public query that lacks a WHERE status = 'approved' filter exposes every pending, rejected, and spam entry to visitors. This violates OWASP A01 (Broken Access Control) and CWE-285 (Improper Authorization): your access control policy says only approved content is public, but the data layer does not enforce it.

Add a status column defaulting to 'pending' and filter all public queries to status = 'approved'. Apply the change in the schema and every listing query:

ALTER TABLE listings ADD COLUMN status VARCHAR NOT NULL DEFAULT 'pending';
CREATE INDEX idx_listings_status ON listings(status);

// Always filter public reads
export async function getApprovedListings() {
  return db.listings.findMany({ where: { status: 'approved' } })
}

// On submission, never set status to 'approved'
await db.listings.create({ data: { ...parsed, status: 'pending' } })

Admin routes that approve or reject should update status and record approved_at / rejected_at timestamps.