diff --git a/client/src/store/authStore.js b/client/src/store/authStore.js
index 9c8ebde..a7a84f8 100644
--- a/client/src/store/authStore.js
+++ b/client/src/store/authStore.js
@@ -46,6 +46,11 @@ const useAuthStore = create((set) => ({
             // Hit the new lightweight endpoint
             const res = await api.get('session/');
 
+            // 🔨 Security Fix a broken API call, Verify we actually got a user object back, not HTML fallback text
+            if (typeof res.data === 'string' || !res.data.username) {
+                throw new Error("Received invalid data format instead of user session");
+            }
+
             // Rehydrate the store with the user's info!
             set({
                 isAuthenticated: true,