Repository navigation
docs: UX + technical review with phased optimization plans (2026-09-05) - #53
Merged
Merged
Conversation
- cloudbuild.yaml deploy step now uses --update-env-vars / --update-secrets instead of --set-env-vars. The previous version would have wiped the 6 production secret bindings (DATABASE_URL, NEXTAUTH_SECRET, GOOGLE/APPLE OAuth, RESEND, CRON) and replaced them with literal "your-secret-here" placeholders on every deploy — potential data/auth outage on any trigger. - Tag images by $BUILD_ID (immutable, unique per build) plus :latest, so rollback is one gcloud run deploy --image=...:$BUILD_ID away. - Mirror current Cloud Run config: cpu=1, memory=512Mi, max-instances=20. - Push happens via images: block (no separate push step). - Add .dockerignore to keep local node_modules / .next / .env / secrets out of the build context — avoids macOS native binaries clobbering the Linux ones produced by the deps stage. - Add .gcloudignore so gcloud builds submit uploads ~3 MiB instead of 1 GB. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Lets local prisma seed / one-off TypeScript scripts run via npx tsx without a separate ts-node toolchain. devDependency only — does not affect the runtime image (Next.js standalone build strips dev deps). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Full-project review against origin/main b868319: UX audit (IA, home, discovery, detail pages, funnels, a11y/i18n, copy checklist, U0–U3 plan) and technical audit (P0 security/ops incl. leaked DB password and Apple secret expiry, correctness defects not covered by PR #52, performance, engineering, T0–T3 plan). Indexed from docs/README.md. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Owner
Author
|
The implementation of this review is now open as #54 — it carries the fixes for the findings here, and merges #52 in as well. Two items in these documents are not fixable in code and still need action:
|
Both documents describe the state at 2026-09-05, and #54 has since implemented most of them. Without this header a reader meeting these files on main would take fixed problems for open ones — and would miss which two items code cannot close (the leaked database password and the Apple key expiry). Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Full UX + technical review of TakoAPI as of
origin/main@b868319c, with phased optimization plans and acceptance criteria:/agents,/skills,/trending,/scenarios), detail pages, developer & publisher funnels, accessibility / i18n, copy checklist; plan U0–U3.docs/README.md— index entries.How it was produced
Line-by-line walkthrough of all 130
src/**files,prisma/,scripts/, deploy + CI config;tsc/lint/build/check:i18n/npm auditrun locally; livecurlmeasurements (TTFB, headers, SSR check); read-onlygcloud run services describe; every finding cross-checked against the open PR #52 so nothing it already fixes is re-reported (see appendix B of the tech doc).scripts/deploy-sync-job.shcontains the production Cloud SQL password in plaintext in a public repo (since 2026-07-04, never rotated) — rotate immediately.APPLE_CLIENT_SECRETJWT expires 2026-09-25.--no-cpu-throttling, so post-response writes (billing, request log) are unreliable.Shareable rendering of both docs: https://claude.ai/code/artifact/718e48f0-e923-4a91-88d9-9533228c70ca
🤖 Generated with Claude Code