Check if these issues are valid — if so, understand the root cause of each and fix them.


<file name="apps/web/modules/signup-view.tsx">

<violation number="1" location="apps/web/modules/signup-view.tsx:3">
P0: Bug: `import process from "node:process"` will break at runtime in this `"use client"` component. The `node:` protocol is Node.js-only and unavailable in the browser. Next.js already handles `process.env.NEXT_PUBLIC_*` substitution at build time, so this import is both unnecessary and harmful. Remove this line.</violation>
</file>

<file name="apps/web/app/api/auth/signup/handlers/calcomSignupHandler.ts">

<violation number="1" location="apps/web/app/api/auth/signup/handlers/calcomSignupHandler.ts:307">
P1: Premium username signups bypass the watchlist review entirely. When `checkoutSessionId` is set (premium username flow, HTTP 402), the handler returns early before reaching the `signupWatchlistReviewEnabled` check. A user could sign up with a premium username to skip the review/locking mechanism. Consider moving the feature flag check and watchlist logic before the `checkoutSessionId` early return, or adding an equivalent check in the premium path.</violation>
</file>

<file name="apps/web/app/api/auth/signup/handlers/selfHostedHandler.ts">

<violation number="1" location="apps/web/app/api/auth/signup/handlers/selfHostedHandler.ts:238">
P2: Missing `select` clause on `prisma.watchlist.create`. The return value is not used, but Prisma still fetches all columns. Add `select: { id: true }` to be consistent with the project's Prisma querying guidelines and the `findFirst` call just above.</violation>
</file>

Check if these issues are valid — if so, understand the root cause of each and fix them.


<file name="apps/web/app/api/auth/signup/handlers/calcomSignupHandler.ts">

<violation number="1" location="apps/web/app/api/auth/signup/handlers/calcomSignupHandler.ts:307">
P3: This existence check now pulls the full watchlist record via `findBlockedEmail`, which selects many fields. For signup flow you only need to know if a record exists; fetching extra columns adds unnecessary data exposure and overhead. Prefer a select that only returns `id` (or add a repo method that does so).</violation>

<violation number="2" location="apps/web/app/api/auth/signup/handlers/calcomSignupHandler.ts:331">
P1: Rule violated: **Avoid Logging Sensitive Information**

Avoid logging sensitive tokens. The checkoutSessionId is a payment session identifier and should not be written to logs per the sensitive-data logging rule.</violation>
</file>

Check if these issues are valid — if so, understand the root cause of each and fix them.


<file name="apps/web/app/api/auth/signup/handlers/calcomSignupHandler.ts">

<violation number="1" location="apps/web/app/api/auth/signup/handlers/calcomSignupHandler.ts:304">
P2: Invite-based signups will now be forced into watchlist review because the `!token` guard was removed. Team invite signups are expected to bypass review mode, so this change will lock invited users and add them to the watchlist.</violation>
</file>

Check if these issues are valid — if so, understand the root cause of each and fix them.


<file name="apps/web/app/api/auth/signup/handlers/calcomSignupHandler.ts">

<violation number="1" location="apps/web/app/api/auth/signup/handlers/calcomSignupHandler.ts:304">
P2: The added `&& !token` guard disables watchlist review for token-based/invite signups, which contradicts the stated requirement that the review applies to all signups when the flag is enabled. This allows those signups to bypass watchlist entry and locking.</violation>
</file>

Check if these issues are valid — if so, understand the root cause of each and fix them.


<file name="packages/trpc/server/routers/viewer/admin/lockUserAccount.handler.ts">

<violation number="1" location="packages/trpc/server/routers/viewer/admin/lockUserAccount.handler.ts:39">
P2: Unlocking a user deletes any blocked email entry regardless of why it was blocked. This can remove manually managed or policy-based watchlist entries; consider only deleting entries created for the signup-review flow (e.g., source == SIGNUP).</violation>
</file>