Our admin panel answers 404 to every signed-in account that is not on a hardcoded list
Who counts as an operator is a constant in the source, not a column or an env var. Thirteen call sites re-check it, and the refusal is a 404.
🎯 Vulnerability: Remote Code Execution (RCE)
💡 Defense Fix: Avoid executing shell commands via system(). Use parameterized APIs and strict input sanitization.