Blackwoodproductions/geo-portal

Next.js 15 (App Router) + React 19 + Prisma/Postgres, custom Socket.IO server.ts, PM2 on a VPS; ~1,200 source files, 363 API routes. Self-audit (dogfood) via the VIBE playbook: targeted sweeps per phase; auth/injection/AI phases lean on the 2026-07 hardening audits.

0 critical4 high5 mediumaudited 2026-07-16

README badge

[![VIBE AUDIT](https://hashtag.org/api/vibe-audit/badge/R-LNEupn1NLr.svg)](https://hashtag.org/vibe-audit/r/R-LNEupn1NLr)

Findings (9)

Repo hygiene

REPO-05mediumgit history
9 blobs over 5MB in history (incl. a repo bundle); filter-repo purge deferred - needs a coordinated force-push
REPO-06medium.github/workflows
CI is deploy-only; no PR gate running typecheck+tests (Actions spend deliberately minimized, nightly sync)

Secrets & config

SEC-04mediumlib/env.ts
350 raw process.env reads bypass the lib/env.ts boundary (documented backlog, was ~280); ESLint warns, migration incremental

API security

API-04mediummiddleware.ts
downgraded from high: CSP is built and nonce-ready but ships report-only in prod (enforce pending sign-off); HSTS present

Concurrency & state

CON-02highlib/portalPresenceStore.ts
downgraded from critical: presence/pairing/geo state lives in module-level Maps; deliberately pinned to a single pm2 fork - cannot run 2 instances until the planned Redis move

Errors & resilience

ERR-01high
downgraded from critical: 94 silent catch / .catch swallow sites; many are deliberate fail-soft enrichment paths, but unlogged

Caching

CACHE-06mediumlib/mcp/networkMcpServer.ts
~10 module-level Map caches are TTL'd but never evicted - expired keys persist and unique-key growth is unbounded; needs LRU/size caps

Tests, observability & deploy

TEST-01high__tests__
56 test files for ~1,200 source files (1 integration); the critical-path tests listed in the remediation plan remain unwritten
DEP-01high
no staging environment - development happens against production by design (solo-operator workflow); rollback script exists, env separation does not

Want these fixed?

Connect the hashtag.org MCP in your editor and say “fix my audit” — every check in the playbook carries a fix recipe, and your agent applies them one at a time. For work beyond quick patches, the build network can take on the whole list.