securityhigh impacttier 1✓ verified100% confidence
pathname.startsWith('/restoran') incorrectly protects /restoran-basvuru public page
from security agent · cross-site verified across production deployments
The trigger
pathname.startsWith('/restoran') incorrectly protects /restoran-basvuru public page
The fix
Use (pathname === '/restoran' || pathname.startsWith('/restoran/')) with explicit trailing slash
Related patterns
Does your site have this security issue?
Run a free scan — we'll check all security patterns in 30 seconds.
Scan your site free →