`Forza/review.md`

34 lines
## Snapshot
- Static website mockups/full-site prototype for FORZA, a Costa Rica law/tax/outsourcing firm.
- Stack: HTML, CSS, vanilla JS; nginx static hosting; datastore: none.
- How it's run: Kamatera nginx + git `post-receive` deploy per `README.md:16-20`, `README.md:56`.
- Status: stale - DNS/SSL open; mockups still root.

## Top Risks (P0 — fix this week)
- `index.html:17-21` public root is a “3 theme mockups” chooser, not the winning production site; visitors land on internal design artifacts. Fix: make root serve `theme-3-costa-rica-modern/` or redirect permanently.
- `theme-3-costa-rica-modern/contact/index.html:115`, `theme-3-costa-rica-modern/index.html:555` lead forms call `preventDefault()` and never send data; real leads are silently lost or shown a mockup alert. Fix: wire to a form backend/mail handler with success/error states.
- `theme-3-costa-rica-modern/index.html:14`, `contact/index.html:13`, `about/index.html:15`, `services-legal/index.html:15` load Figma MCP capture JS in production pages; third-party design tooling can execute on every visitor session. Fix: remove from deploy or gate behind local/dev-only build.
- `README.md:6`, `README.md:63`, `DIARY.md:164` SSL/DNS are documented as unfinished; site may be unreachable or HTTP-only. Fix: confirm DNS A record, run certbot, force HTTPS.
- Known SQL injection/auth/CVE issues: none observed; there is no backend, auth layer, SQL, or package manifest.

## Notable Issues (P1 — fix this month)
- `README.md:27`, `DIARY.md:116`, `DIARY.md:272` document root SSH/deploy operations publicly; not a secret, but unnecessary recon material. Fix: move infra runbook to private notes and deploy with a non-root user.
- `theme-3-costa-rica-modern/contact/index.html:184` privacy policy is `href="#"` while collecting personal data. Fix: add real privacy page before enabling forms.
- `theme-3-costa-rica-modern/index.html:489`, `index.html:551-552`, `contact/index.html:249-266`, `contact/index.html:321-323` core CTAs are dead `#` links. Fix: replace with `tel:`, `mailto:`, WhatsApp, maps, or real pages.
- `theme-3-costa-rica-modern/index.html:15-224` duplicates much of `shared.css`; future style changes will drift across homepage vs subpages. Fix: migrate homepage to shared CSS.
- `README.md:41-42` says About and Legal are planned, but files exist; docs no longer match reality. Fix: update structure/deploy notes.

## Polish (P2 — when convenient)
- Add a minimal link checker for `href="#"`, broken relative links, and missing anchors.
- Add real `mailto:`/`tel:` semantics for visible email and phone.
- Remove obsolete alternate themes from production routing if they are only design history.

## Strengths
- Clear static deployment model is documented in `README.md:8-23`.
- Theme 3 uses shared CSS for subpages, making the multi-page build easier to maintain.
- Content is specific and SEO-oriented, not placeholder-heavy.

## Open questions for the owner
- Is `forza.agentabrams.com` intended as public production or only a staging/design review URL?
- Should alternate themes remain publicly accessible?
- What system should receive contact form leads: email, CRM, Google Sheet, or existing automation?