Security review of web app sign-in, invites and account deletion (TypeScript/Node)

We need a security review of a TypeScript/React PWA with a Hono server and Postgres. Review Apple and Google OAuth and magic-link sign-in, trip invitations, and account deletion. After a mutual NDA, you will get read-only GitHub access at a named commit; cloning and running locally is OK. No production or live testing. Deliver written findings by Monday November 16, 2026: severity, file/line, what could go wrong, and a recommended fix. Out of scope: building features, changing production, publishing write-ups, or sharing code. Budget about $250 (fixed-price).