Claimed listings show Verified Owner badge set server-side only

A verified owner badge that is set client-side or derived from user-supplied input is cosmetic — any user can fake it by editing the DOM or intercepting the API response. Visitors rely on the badge to distinguish operator-managed listings from third-party submissions. When the badge is fabricated, trust signals collapse and the directory's credibility is undermined. CWE-285 and OWASP A01 (Broken Access Control) apply: authorization state must always originate from the server.

Render the badge exclusively from server-fetched data. Never pass a isVerified prop from client state or URL params — derive it from claimed_at in the database row:

// app/listings/[id]/page.tsx (server component)
const listing = await db.listings.findUniqueOrThrow({
  where: { id: params.id },
  select: { title: true, description: true, claimed_at: true }
})

return (
  <article>
    <h1>{listing.title}</h1>
    {listing.claimed_at && (
      <span className="badge-verified">Verified Owner</span>
    )}
  </article>
)

Never expose a claimed_at override via any public-facing API endpoint. The field should only be writable by the claim verification flow in app/api/listings/[id]/verify-claim/route.ts.