Great you decided to share the source code, but then I was able to see that you let the admin session enabled. you can disable that on production
https://stackoverflow.com/questions/4845239/how-can-i-disabl...
https://stackoverflow.com/questions/4845239/how-can-i-disabl...
Still there's no admin user configured so it's safe