Missing authentication in the realtime streams POST handler allows unauthenticated attackers to inject arbitrary data into run streams across any environment, including production. This occurs because the `action` handler in the file `apps/webapp/app/routes/realtime.v1.streams.$runId.$streamId.ts` lacks an authentication wrapper. Furthermore, the system performs run lookups using the `friendlyId` variable without verifying the `runtimeEnvironmentId`, and these identifiers follow predictable patterns. The affected API endpoint is '/realtime/v1/streams/:runId/:streamId'.