Audit everything admin-related in my app: admin pages, admin API endpoints, impersonation features, seeded or default admin accounts, and any backdoor-style access (special query params, hardcoded emails that skip checks). Verify: every admin endpoint enforces a server-side role check (not just a hidden link in the UI); the role itself can't be modified through any user-facing endpoint; no default or seeded admin credentials exist in production code or fixtures (check for classics like [email protected] with a known password); no debug endpoints are reachable in production (routes like /debug, /test, /api/dev that bypass auth); and admin actions that matter (refunds, user deletion, role changes) are logged with who did them. Do not remove the admin functionality; just gate it properly. If seed data needs an admin for local development, make it explicit that it only applies to development environments. Deliver a list of every admin surface, its protection before and after, any backdoors found and removed, and a verification pass: a non-admin account that gets refused at each admin endpoint, and confirmation no default credentials work.