Audit My Project for Security Problems

Audit this project for security problems and report findings by severity before changing anything.

Check:
1. Are any secret keys or service credentials reachable from frontend code?
2. Does every table holding real data have row level security enabled with policies that are not simply "true"?
3. Can one user read or modify another user rows anywhere?
4. Are role checks performed server-side on every privileged action, not only in the interface?
5. Is user input validated on the server before being stored or passed to another service?
6. Are public endpoints — webhooks and public APIs — verifying their caller?
7. Does any error message leak internal details to users?

For each finding give the severity, the exact location and the fix. Then fix the critical ones.