Your Middleware Is Not a Security Boundary (59,000 Servers Just Found That Out)

3:47 AM, and a pager alert for unusual traffic on /api/admin/* . Routes that should have been sealed off behind middleware.ts , returning a clean 401 to anyone without a session cookie. Except the log...