fix: a signed-out visitor to a startup form step is sent to login

[thomgabriel]

Since #117 the hero only renders on the first screen, so a signed-out person opening /startup-registration?step=4 got an empty page: no form, no login prompt. That is the link the feedback e-mail will use. They are now redirected to /auth?next=/startup-registration?step=4 and come back to the same step. Without a step the page still shows the hero.

Checked on a local server: step 4 signed out answers with the redirect, and the plain page and ?step=done still render the hero.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
hackathon-platform	Ready	Preview	Oct 2, 2026 5:21pm UTC

[claude]

Claude finished @thomgabriel's task in 10s —— View job

---

Safe to merge. No findings.

Checked:

• Redirect condition: only fires when !state && requested. A plain page and ?step=done still render the hero, and a signed-in user is unaffected.
• next value: it is built from the whitelisted requested step number and URL-encoded, so there is no open-redirect or injection surface. The auth page and callback read it through pickAuthNext.
• Redirect position: it runs before any data is rendered, and loadStartup is skipped when there is no state, so no unauthenticated query runs.
• Conventions: no service-role use, no new copy, and the comment explains why.

[claude]

Claude finished @thomgabriel's task in 11s —— View job

---

Safe to merge. No findings.

Checked: the redirect fires only when !state && requested, so the plain page, ?step=done and signed-in users are unchanged. next is built from the whitelisted step number plus UTM values that are length-capped and URL-encoded, and it goes through pickAuthNext/sanitizeRedirect on the auth side. The redirect runs before any data query. No service-role use, no new copy, and the comment explains why.