The endpoints your app publishes

The browser has to know where to send requests, so these paths are necessarily in your bundle. That is not a problem and there is nothing to fix.

It is here because reading the list is the fastest way to notice the endpoint you forgot you built — the debug route from three features ago, the admin action added during a late-night fix.

Where a path looks administrative or internal, we flag it separately. Knowing the exact path is most of the work in finding an unprotected admin route.

For each, find the server code and confirm it verifies both identity and role. Do not accept "it is fine" from an AI tool without seeing the check.

Anything that should not be reachable from a browser at all should have its calling code moved out of the client bundle, so the path is not published.