{
  "id": 14173849,
  "title": "Our admin panel answers 404 to every signed-in account that is not on a hardcoded list",
  "url": "https://urgent.news/2026/10/13/our-admin-panel-answers-404-to-every-signed-in-account-that-is-not-on",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-13T10:10:58.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/daniel_pertu/our-admin-panel-answers-404-to-every-signed-in-account-that-is-not-on-a-hardcoded-list-4l06"
  },
  "original_language": "en",
  "account": "Nakodo's admin panel is accessible at /admin and features six pages, including accounts, plans, campaign counts, support threads, inbound mail, and background run logs. This panel has access to other people's data, as outlined in the privacy notice. The question is how the panel determines user identity and the consequences when a user is denied access. There is no is_admin column or ADMIN_EMAILS environment variable, but the list is present in the source code. The panel does not provide a 403 response when a user is not an admin; instead, it returns a 404, silently acknowledging its existence to users who have made a free account and typed a URL. The metadata for the panel indicates that robots should not index or follow the page, and it is force-dynamic, meaning it cannot be statically rendered. There are 13 call sites for the isAdminEmail function across 8 files, with each Server Action checking the allowlist before executing. The admin panel's gate is a per-request decision, meaning that actions within the panel cannot be cached or statically rendered.",
  "summary": "Nakodo has an operator panel at /admin : six pages that read the whole service. Accounts, plans, campaign counts, support threads, inbound mail, the background run log. It is the one surface in the product that can see other people's data, which is exactly the data the privacy notice promises to keep to a short list of uses. So the interesting question is not what the panel shows. It is how it…",
  "key_points": [
    "Nakodo admin panel accessible at /admin with six pages",
    "Admin identity determined by allowlist, not isadmin column",
    "404 response returned for non-allowed signed-in accounts"
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}