Ideate

The server has critical security vulnerabilities. A hardcoded token '123abcd' in `apps/ws-backend/src/index.ts` allows any client using this token to impersonate a specific user ('32cc98f7-172c-4ed6-a4a1-2e9605ce8f71'), effectively creating a backdoor for unauthorized access. The `JWT_SECRET` in `@repo/backend-common/src/index.ts` has a weak default fallback ('randomPhoenixSecret'), making JWTs easily forgeable if the environment variable is not explicitly set in production. Additionally, the `/api/v1/room/chat/:slug` endpoint in `apps/http-backend/src/routes/room.route.ts` is not protected by authentication middleware, allowing unauthenticated access to room details and chat history by anyone who knows a room's slug. There is also no explicit message validation for WebSocket chat messages and rate limiting is noted as a TODO, which could lead to abuse.