Our admin panel answers 404 to every signed-in account that is not on a hardcoded list
Nakodo has an operator panel at /admin : six pages that read the whole service. Accounts, plans, campaign counts, support threads, inbound mail, the background run log. It is the one surface in the product that can see other people's data, which is exactly the data the privacy notice promises to keep to a short list of uses. So the interesting question is not what the panel shows. It is how it…
Nakodo's admin panel is accessible at /admin and features six pages, including accounts, plans, campaign counts, support threads, inbound mail, and background run logs. This panel has access to other people's data, as outlined in the privacy notice. The question is how the panel determines user identity and the consequences when a user is denied access.
There is no is_admin column or ADMIN_EMAILS environment variable, but the list is present in the source code. The panel does not provide a 403 response when a user is not an admin; instead, it returns a 404, silently acknowledging its existence to users who have made a free account and typed a URL. The metadata for the panel indicates that robots should not index or follow the page, and it is force-dynamic, meaning it cannot be statically rendered.
There are 13 call sites for the isAdminEmail function across 8 files, with each Server Action checking the allowlist before executing. The admin panel's gate is a per-request decision, meaning that actions within the panel cannot be cached or statically rendered.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
