[overnight] pre-debate baseline

8e1253cba16671022c02152d01d3bec0a3eb04d1 · 2026-05-04 06:39:14 -0700 · SteveStudio2
Files touched

A .env
A .env.example
A CHANGES.md
A README.md
Diff

commit 8e1253cba16671022c02152d01d3bec0a3eb04d1
Author: SteveStudio2 <stevestudio2@SteveStacStudio.lan>
Date:   Mon May 4 06:39:14 2026 -0700

    [overnight] pre-debate baseline
---
 .env         |  5 +++++
 .env.example |  2 ++
 CHANGES.md   | 11 +++++++++++
 README.md    | 13 +++++++++++++
 4 files changed, 31 insertions(+)

diff --git a/.env b/.env
new file mode 100644
index 0000000..cd64989
--- /dev/null
+++ b/.env
@@ -0,0 +1,5 @@
+# Google Maps Platform — restricted to claimmyaddress.com referrers (see GCP project stevestreet-494819)
+GOOGLE_MAPS_API_KEY=AIzaSyDP-lKLvCQNPUvJ3mxyl1bjBHFO5g57ETw
+GOOGLE_GEOCODING_API_KEY=AIzaSyCr_VbbAcpGeY0CRnTV-YcCQENGOLrbxg0
+
+DPLA_API_KEY=3aebfb2284a8eb961962ce8e06eeecd5
diff --git a/.env.example b/.env.example
new file mode 100644
index 0000000..e61222a
--- /dev/null
+++ b/.env.example
@@ -0,0 +1,2 @@
+GOOGLE_MAPS_API_KEY=your_browser_key_here_referrer_restricted
+GOOGLE_GEOCODING_API_KEY=your_server_key_here_ip_restricted
diff --git a/CHANGES.md b/CHANGES.md
new file mode 100644
index 0000000..3a12b40
--- /dev/null
+++ b/CHANGES.md
@@ -0,0 +1,11 @@
+## Applied
+- CHANGES.md:1 - documented the safe-fix pass - required by FIX mode; no source-code safe fixes were available in this scaffold-only repo.
+
+## Deferred (needs Steve)
+- P0 - .env:2-5 - live Google Maps, Google Geocoding, and DPLA API keys are stored in plaintext - deferred because rotating real secrets and moving them to a secret store requires Steve; `.env` was left untouched.
+- P0 - .env:3 - `GOOGLE_GEOCODING_API_KEY` may be billable if not strictly restricted - deferred because verifying GCP restrictions and rotating the key requires Steve.
+- P0 - README.md:7-9 - repo claims signup, OAuth, claims, uploads, inventory, insurance export, shared backend, DB, and MCP, but no implementation exists here to review - deferred because the shared backend location and production architecture need Steve.
+- P1 - README.md:5 - master plan lives outside this repo - deferred because copying architecture/runbook details is documentation work outside the approved safe-fix list.
+- P1 - .env.example:1-2 - `DPLA_API_KEY` placeholder is missing - deferred because this was not a hardcoded source fallback secret and is outside the approved safe-fix list for this pass.
+- P1 - Project root - `.gitignore` is missing while `.env` exists beside project files - deferred because adding repo policy files was outside the approved safe-fix list for this pass.
+- P1 - Project root - no package manifest, tests, routes, DB migrations, or deploy config exist - deferred because creating application structure is not a small surgical safe fix.
diff --git a/README.md b/README.md
new file mode 100644
index 0000000..35bdf03
--- /dev/null
+++ b/README.md
@@ -0,0 +1,13 @@
+# claimmyaddress.com
+
+Onboarding / login surface for the three-domain home-history ecosystem.
+
+**Master plan:** [`~/Projects/wholivedthere/PLAN.md`](../wholivedthere/PLAN.md)
+
+This domain handles: signup, OAuth, claim flow, document upload, receipts vault, items inventory, insurance pack export.
+
+Backend, DB, and MCP are shared with the sibling domains. Do not duplicate any code or schema here — read PLAN.md first.
+
+Sister domains:
+- `wholivedthere.com` — flagship browse/discovery
+- `bubbesblock.com` — community
(oldest) · back to Claimmyaddress · add canonical .gitignore per standing rule affd4f6 →