Expected Findings
- Admin and bypass flags are client-side and default-enabled.
Client Boot Flags
Feature Flag App
The app starts with unsafe feature flags in the browser, enabling admin affordances and auth bypass logic before any server confirmation exists.
Runtime flags
Primary Flows
- UI config Feature flag JSON returned to the browser
Signals
Flags
window.FEATURE_FLAGS = { enableAdmin: true, bypassAuth: true }