Webapp Security Audit

This codebase has a solid foundation (Stripe signatures verified, Zod schemas everywhere, RLS enabled on every table), but contains several high-severity issues concentrated in the payment, auth, and worker-dispatch paths. The most urgent findings are a missing idempotency check on the Stripe webhook (duplicate deliveries credit users twice), a GitHub OAuth access token exposed to client-side code via the NextAuth session callback, and Supabase RLS that allows anonymous writes against the `payments` table because no INSERT/UPDATE/DELETE policies were defined. A TOCTOU race in the daily scan limit and a path-traversal vector in the repo-clone branch parameter round out the critical set. Without intervention, an attacker can mint free credits, exfiltrate user GitHub tokens, or write directly to financial tables from a browser bundle.