Guest User

Open your admin dashboard, open devtools, and switch to the network tab. Sort by domain and count the hostnames that are not yours. On most panels built by a small team the number lands somewhere between three and eight, and at least one of those third parties is receiving a live reconstruction of whatever is currently rendered on screen.

Open the package.json of your admin dashboard and count the dependencies you deliberately added. Then run npm ls --all and count what is actually there. For a typical React admin template the second number lands somewhere between eight hundred and fifteen hundred packages, and you personally selected maybe thirty of them. The rest arrived uninvited, and every one of them runs with the same access to the page as the code you wrote yourself.

Every application has one surface where a single compromised session hands over everything at once. The user table, the billing records, the CSV export, the impersonation feature somebody added in month three and never removed. That surface is the admin dashboard, and it tends to be the least-reviewed code in the whole repository, because it got scaffolded from a template in an afternoon and nobody went back to it once the feature work started.