Hey everyone! I’ve built a simple credentials-auth implementation with Next.js and would love some feedback on potential security flaws. The app includes:

- Sign up/login (username, email, password)
- Settings page (only accessible when logged in, for username change & logout)

I’m aware of the lack of brute-force protection, which I'll work on soon. Tech stack: Next.js, Redis (session management), Prisma/PostgreSQL (user storage), Zod validation.

I’m still scraping the surface of programming, and this is my first Next.js/auth project!
Repo: https://github.com/montizo/melon
Thanks for your help!