Moderation workflow prevents unreviewed reviews from displaying

Without a status column defaulting to 'pending' and a filter on every public display query, your review page is an open broadcast channel — any submitted content, including spam, competitor attacks, and profanity, appears live to all shoppers immediately. CWE-284 (Improper Access Control) covers exactly this: the resource (a published review) is accessible to users who should not have triggered that state transition (published). Even one unfiltered display query is enough to leak pending reviews; attackers simply POST then GET before moderation runs.

Add a status column to the reviews table via migration and apply WHERE status = 'approved' to every public-facing query in lib/reviews.ts and api/reviews/route.ts.

-- Migration
ALTER TABLE reviews ADD COLUMN status VARCHAR(20) NOT NULL DEFAULT 'pending';
CREATE INDEX idx_reviews_status ON reviews(status);

// lib/reviews.ts — the single place all display queries should live
export async function getApprovedReviews(productId: string) {
  return db.reviews.findMany({
    where: { product_id: productId, status: 'approved' },
    orderBy: { created_at: 'desc' }
  })
}

Search the codebase for every db.reviews.findMany and SELECT * FROM reviews call and verify each one includes the status filter. Related: ecommerce-reviews.moderation-trust.spam-detection for automated pre-screening before insert.