Missing auth guard on a state-changing or sensitive route

What it is

A route that changes state or returns sensitive data has no authentication guard before its handler body runs.

Why it matters

The endpoint is open to anyone who finds it, and unlisted is not unfindable — routes turn up in bundles, in crawlers, and in the API clients you publish.

How to fix it

Apply the auth guard through a wrapper or middleware that every route goes through, so protection is the default and an exception has to be written deliberately. Assert the guard in a test for each state-changing route.