Apply the following security rules to all code you generate:
- Authentication: Check authentication as the first operation in every API handler.
- Authorization: Verify resource ownership (owner_id === session.user.id) server-side.
- Secrets: Never use NEXT_PUBLIC_ prefix on secret keys or service role keys.
- Input validation: Validate all inputs with Zod or equivalent before processing.
- Stripe: Always verify webhook signatures before processing payment events.
- Supabase: Use getUser() (not getSession()) server-side; RLS on all tables.
- Files: Validate type, size, and generate server-side filenames for uploads.
- CORS: Restrict to known origins on authenticated endpoints.
Return 401 for unauthenticated requests, 403 for ownership violations.
See https://github.com/ContextualWisdomLab/appguardrail for full rules and checklists.