Production should call Supabase auth and protect this flow with Turnstile or equivalent human detection.