`claimmyaddress/review.md`

31 lines

## Snapshot
- `claimmyaddress.com`: scaffold/readme for onboarding/login/claim flow in a shared home-history ecosystem.
- Stack: none present; no app source, package manifest, runtime, or datastore config in this directory.
- How it's run: unclear; no pm2/systemd/launchd/cron/deploy config observed.
- Status: stale/scaffold only; no source code present.

## Top Risks (P0 — fix this week)
- `.env:2-5`: live API keys are stored in plaintext in the project directory; if synced, backed up, or later committed, they are exposed. Rotate these keys, move secrets to a real secret store, and keep only `.env.example`.
- `.env:3`: `GOOGLE_GEOCODING_API_KEY` is a server-side key; if not strictly IP/service-account restricted, it can be abused for billable requests. Verify restrictions in GCP and rotate after removal.
- `README.md:7-9`: this repo claims it handles signup, OAuth, document upload, inventory, and insurance export, but no implementation exists here. Security review of auth/upload/data handling cannot be performed from this repo; review the shared backend before launch.

## Notable Issues (P1 — fix this month)
- `README.md:5`: core plan lives in `../wholivedthere/PLAN.md`, outside this project. A future maintainer cannot understand requirements from this repo alone; copy a short architecture/runbook summary here.
- `.env.example:1-2`: example config omits `DPLA_API_KEY` from `.env:5`, so local setup will drift or fail when code eventually depends on it. Keep required env vars complete with placeholder values.
- Project root: no `.gitignore` observed, and `.env` exists beside project files. Add ignore rules before initializing or importing this into git.
- Project root: no package manifest, tests, route files, DB migrations, or deploy config observed. This is not an auditable application yet.

## Polish (P2 — when convenient)
- `README.md:7`: list the actual sibling/shared service names and where auth, uploads, receipts, inventory, and exports are implemented.
- `README.md:9`: “Backend, DB, and MCP are shared” is useful, but incomplete; include the datastore name, service URL/env contract, and deployment owner.
- Project root: add a minimal `README` section for setup, required env vars, and production deployment path.

## Strengths
- `README.md:9`: clear intent to avoid duplicated backend/schema logic across sibling domains.
- `.env.example:1-2`: uses placeholder values instead of copying the real Google keys.
- `README.md:11-13`: sibling-domain context is explicit, which helps avoid treating this as an isolated product.

## Open questions for the owner
- Where is the shared backend that actually implements signup, OAuth, claims, uploads, and exports?
- Is this directory intended to become a deployable app, or only a domain-specific placeholder?
- Have the Google and DPLA keys in `.env` ever been committed, synced, or shared outside this machine?