Authentication required on non-public endpoints

Unprotected API endpoints that serve user-specific data or perform mutations are the canonical realization of OWASP A01:2021 (broken access control) and CWE-306 (missing authentication for critical function). The specific AI-generated antipattern — reading a userId from the request body rather than the verified session — maps to CWE-639 (authorization bypass through user-controlled key), enabling any authenticated user to read or mutate any other user's data by supplying a different ID. Frontend auth checks are irrelevant: API routes are directly callable via curl.

Gate all non-public routes in src/middleware.ts with a route matcher, then derive the user identity exclusively from the verified session inside handlers — never from request body:

// app/api/users/me/route.ts
export async function GET(req: Request) {
  const session = await getServerSession(authOptions)
  if (!session) return new Response(null, { status: 401 })

  // Use session.user.id — never req.body.userId or searchParams.get('userId')
  const user = await db.user.findUnique({ where: { id: session.user.id } })
  return apiSuccess(serializeUser(user))
}

Any handler that currently accepts a userId in the request body and queries with it is a horizontal privilege escalation vulnerability — replace those immediately with session-derived IDs.