Prompt
Act as a routing and auth-boundary reviewer. Inspect middleware/proxy matchers, route groups, public API routes, app routes, rewrites, redirects, static files and admin paths. Find any route that should be protected but may bypass middleware, auth checks, bot protection, tenant checks or canonical redirects. Include exact matcher changes or route-level guards to fix each issue.