Check · Auth

The login screen isn't a lock.

Your app shows a login form, hides the admin panel from regular users, and remembers who's signed in. That's a UI. The API behind it may still answer anyone who asks, and vibe-coded apps tend to make the browser enforce rules the server never heard of.