Authenticated submission enforced or incentivized; anonymous submissions without anti-spam controls flagged

Treating anonymous and authenticated submissions identically removes a key signal the moderation queue needs to prioritize risk. Anonymous submissions cannot be traced, appealed, or associated with a reputation history — they are statistically higher-risk. OWASP A07 (Identification & Authentication Failures) applies when the system cannot distinguish the source of an action. Without auth differentiation, a bot network using throwaway emails receives the same moderation weight as a verified long-standing user.

Either require authentication at the route level, or record authentication status and route anonymous submissions to a higher-scrutiny queue:

// app/api/listings/submit/route.ts
const user = await getSessionUser(req) // null if unauthenticated

const listing = await db.listings.create({
  data: {
    ...parsed,
    submitted_by: user?.id ?? 'anonymous',
    is_authenticated: !!user,
    // Anonymous submissions start flagged for extra review
    flagged_for_review: !user
  }
})

In the moderation dashboard, surface flagged_for_review = true items with a distinct visual indicator. Set stricter auto-reject thresholds (e.g., spam score) for anonymous submissions than authenticated ones.