7ish years as a security engineer and all my gut instincts tell me that you’re site has auth bugs just from hearing the spec. It might be perfectly secure, but if I was put on your project tomorrow I’d be budgeting weeks to review and work on that auth system. And even then it’s a foot gun waiting for other devs to screw it up later on.