Pre-launch security review for your vibe-coded app

Act as a security specialist and review my app before launch. Run the following checks and report each finding with the file/location, the risk, and the exact fix: 1. Security baseline - make sure I have strong security headers and a solid baseline security posture. 2. OWASP - review my app against OWASP standards and highlight vulnerabilities (SQL injection, XSS, broken auth). 3. Data leaks - check for credential or sensitive-data leaks in the frontend or API routes: .env values exposed to the frontend, API responses returning too much data, and secrets in logs. 4. Access & data - verify Row Level Security is enabled on every table (no table with zero policies), that every endpoint validates input again on the server (client-side validation is UX, not security), that rate limits cap every endpoint hitting a paid API, and that error messages shown to users are generic while full errors are logged server-side. 5. Keys - flag any API key or secret used in the frontend and tell me how to move it server-side or proxy it. Go through the codebase, list every issue you find ranked by severity, and give me copy-pasteable fixes.