`Hormuzy/review.md`

32 lines
## Snapshot
- Static browser game archive for “HORMUZY — Run the Gauntlet.”
- Stack: HTML, bundled React/Three/Tailwind-style CSS inferred; browser runtime; no datastore observed.
- How it's run: static hosting likely; no pm2/systemd/launchd/cron config observed.
- Status: stale: checked-in build is incomplete.

## Top Risks (P0 — fix this week)
- `clone/index.html:43-46`: references `/assets/index-DNA8aLxR.js`, `/assets/three-s7MRw7i5.js`, `/assets/r3f-DrPHa5mf.js`, `/assets/index-Bjz6pQij.css`, none present in repo; local/static deploy renders empty `#root`. Fix by committing full build output or restoring source/build pipeline.
- `clone/manifest.json:17`: references `/icon-512.png`, not present; PWA install/icon fetch breaks. Add the asset or remove the manifest entry.
- Secrets/auth/SQL injection/prod credentials: none observed.

## Notable Issues (P1 — fix this month)
- `clone/index.html:42`, `clone/index.html:50`: third-party scripts execute on every page with no CSP/SRI containment; compromise of either host can run arbitrary code on `hormuzy.com`. Add a restrictive CSP and self-host/pin scripts where feasible.
- `clone/recon.js:1`: hardcoded absolute Playwright dependency path under `/root/Projects/Designer-Wallcoverings`; script fails anywhere except that machine layout. Use a local `package.json` devDependency and `require('playwright')`.
- `clone/recon.js:18`, `clone/recon.js:49`: navigation errors are swallowed with `.catch(() => {})`; screenshots/copy can be generated from failed or blank pages without failing CI. Log and exit nonzero on failed navigation.
- `clone/recon.js:18`, `clone/recon.js:49`: recon validates production `https://www.hormuzy.com/`, not the checked-out `clone/index.html`; it cannot catch this repo’s missing assets. Point it at a local static server in review/build checks.
- `clone/recon/*.png`, `clone/recon/*.webm`: generated screenshots/videos are committed as source; they obscure the tiny actual app payload and will churn. Store as CI artifacts or document why snapshots are canonical.

## Polish (P2 — when convenient)
- No README or run instructions observed; add a short note explaining whether this is source, a deploy artifact, or a one-off clone.
- No package/build metadata observed; future rebuilds are not reproducible.
- `clone/assets/index.css:1`: minified generated CSS is the only stylesheet present; without source, UI changes are effectively hand-editing build output.

## Strengths
- Metadata is reasonably complete: title, description, OG/Twitter tags, manifest, and mobile web app tags are present.
- Recon script attempts desktop and mobile capture, including rendered text extraction, which is useful once pointed at the local build.
- Static-only surface means no observed server-side auth, SQL, or credential exposure risks in this checkout.

## Open questions for the owner
- Is this repo intended to be deployable source, or only a captured snapshot of the live site?
- Where is the original React/Three source and build config?
- Are the external analytics/jam scripts required for the public site?