Real output. Real proof. This is what €9.99 buys.

An unauthenticated GET to /api/customers returned 3 full rows (email, plan, stripe_customer_id) with no session cookie and no API key. The endpoint has no auth middleware.

Two disposable test accounts were created. Account A requested /api/orders?userId=<account-b-id> while authenticated as Account A. The server correctly rejected the mismatched userId.

✓ Account A could not read Account B's orders.

The /api/generate endpoint answered 15 consecutive requests in under 4 seconds with no rate limiting, no per-IP throttle, and no auth check. At current token pricing this extrapolates to roughly $200 per 10,000 requests, billed directly to the connected API key.

A forged Stripe webhook payload (checkout.session.completed, no valid signature) was sent to /api/webhooks/stripe. The endpoint verified the signature and rejected the event with a 400.

✓ Webhook rejected a forged "payment succeeded" event.

The homepage has no <title>, no meta description, and no og:image. Sharing the link in Slack, X, or Product Hunt renders a blank grey box with the raw URL as the only text.