Prototype pollution explained with code: how an unsafe merge lets attackers change Object.prototype, why it leads to authentication bypass, and how to prevent it.