diff --git a/server/auth.mjs b/server/auth.mjs
index 847e4d0..ed943fc 100644
--- a/server/auth.mjs
+++ b/server/auth.mjs
@@ -94,7 +94,9 @@ export async function loginWithGoogle(credential) {
   );
   if (p.aud !== clientId) throw new Error('aud eşleşmiyor');
   if (p.email_verified !== 'true' && p.email_verified !== true) throw new Error('e-posta doğrulanmamış');
-  const email = String(p.email).toLowerCase();
+  if (typeof p.sub !== 'string' || !p.sub.trim()) throw new Error('Google kullanıcı kimliği eksik');
+  if (typeof p.email !== 'string' || !/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(p.email)) throw new Error('Geçerli e-posta eksik');
+  const email = p.email.toLowerCase();
   const isAdmin = isAdminEmail(email);
   const user = {
     email,