Profanity/spam detection or manual review queue is implemented

A review form with no content filtering is an XSS injection surface (CWE-79, OWASP A03:2021 Injection): stored review text rendered without escaping can execute scripts in other users' browsers. Beyond injection risk, unfiltered review text lets competitors post identical five-star spam 100 times over — the only limit is how fast they can POST. A manual admin review queue without automated pre-filtering creates an unmanageable backlog at any real volume. At minimum, one automated layer (a profanity library or AI moderation API call) must run before the INSERT to catch the automated attacks.

Add automated content filtering in api/reviews/submit using a profanity library, then route suspicious submissions through the manual queue at app/admin/reviews/page.tsx.

// api/reviews/submit
import Filter from 'bad-words'
const filter = new Filter()

const cleanText = filter.clean(reviewText)
const isSuspicious = cleanText !== reviewText

await db.reviews.create({
  data: {
    text: cleanText,
    status: isSuspicious ? 'pending' : 'approved',
    // ...
  }
})

// app/admin/reviews/page.tsx
export default async function ReviewQueue() {
  const pending = await db.reviews.findMany({ where: { status: 'pending' }, orderBy: { created_at: 'asc' } })
  return <ReviewModerationTable reviews={pending} />
}

The admin route must be behind an auth check — never expose the moderation queue to unauthenticated users.