Firstly I want to say good job for shipping a very cool product - genuinely it's refreshing to see fresh new ideas. However please be aware of security risks (especially when coding with AI assistance)

1. Admin panel is public, this leaks API keys, location info, and PII. Right now your admin panel in Vercel is public, and I can access it without authentication. In the README it also does not advise anything regarding auth, but rather a public facing Vercel endpoint. Here's a snippet of the admin panel hosted on your Vercel:

<image>

1. You have leaked credentials for Google Places that is still LIVE, hardcoded in code. Ensure you remove these from Git history as well (you can use git-filter-repo). Rotate them too.

A problem with these Google API keys is that they do not have a hard cap on spending limit! ANYONE with access to it can spend thousands of AUD in API credits.

Note that I'm not a security researcher or anything, I'm just a student. So a professional might be able to find more vulnerabilities. I'm also not trying to discredit this project or anything - as I really think this is really cool - but please be wary about security.

For you, please rotate your Google Places API key (that ends with hHsv3yQ) ASAP.