fix production issues

apps/homepage/src/components/auth/SignInForm.tsx

@@ -11,6 +11,16 @@ import { usePathname, useSearchParams } from 'next/navigation';
 import { useState } from 'react';
 import styles from './AuthForms.module.css';
 
+function resolveSafeAppRedirect(candidate: string | null | undefined, fallback: string): string {
+  const value = (candidate ?? '').trim();
+  if (!value) return fallback;
+  if (!value.startsWith('/')) return fallback;
+  if (value.startsWith('//') || value.startsWith('/\\')) return fallback;
+  if (value.includes('://')) return fallback;
+  if (/[\r\n\\]/.test(value)) return fallback;
+  return value;
+}
+
 interface Dict {
   title: string;
   subtitle: string;
@@ -120,7 +130,7 @@ export function SignInForm({
   const [step, setStep] = useState<'credentials' | 'totp'>('credentials');
   const [loading, setLoading] = useState(false);
   const [error, setError] = useState<string | null>(null);
-  const employeeRedirect = searchParams.get('redirect') || '/dashboard';
+  const employeeRedirect = resolveSafeAppRedirect(searchParams.get('redirect'), '/dashboard');
 
   function completeLogin(data: any) {
     if (data?.admin) {