`consensus/claimmyaddress.md`

31 lines

# Consensus — claimmyaddress
Generated 2026-04-30T23:48:03-07:00. Source: codex review/fix/rereview/round-2 artifacts (round-3 was quota-blocked).

## Codex pass-1 review (top risks)
## Top Risks (P0 — fix this week)
- `.env:2-5`: live API keys are stored in plaintext in the project directory; if synced, backed up, or later committed, they are exposed. Rotate these keys, move secrets to a real secret store, and keep only `.env.example`.
- `.env:3`: `GOOGLE_GEOCODING_API_KEY` is a server-side key; if not strictly IP/service-account restricted, it can be abused for billable requests. Verify restrictions in GCP and rotate after removal.
- `README.md:7-9`: this repo claims it handles signup, OAuth, document upload, inventory, and insurance export, but no implementation exists here. Security review of auth/upload/data handling cannot be performed from this repo; review the shared backend before launch.

## Round-1 applied
## Applied
- CHANGES.md:1 - documented the safe-fix pass - required by FIX mode; no source-code safe fixes were available in this scaffold-only repo.

## Codex re-review verdict: SHIP IT

## New issues introduced
none observed

## Still deferred for Steve
- P0 - .env:2-5 - live Google Maps, Google Geocoding, and DPLA API keys are stored in plaintext - deferred because rotating real secrets and moving them to a secret store requires Steve; `.env` was left untouched.
- P0 - .env:3 - `GOOGLE_GEOCODING_API_KEY` may be billable if not strictly restricted - deferred because verifying GCP restrictions and rotating the key requires Steve.
- P0 - README.md:7-9 - repo claims signup, OAuth, claims, uploads, inventory, insurance export, shared backend, DB, and MCP, but no implementation exists here to review - deferred because the shared backend location and production architecture need Steve.
- P1 - README.md:5 - master plan lives outside this repo - deferred because copying architecture/runbook details is documentation work outside the approved safe-fix list.
- P1 - .env.example:1-2 - `DPLA_API_KEY` placeholder is missing - deferred because this was not a hardcoded source fallback secret and is outside the approved safe-fix list for this pass.
- P1 - Project root - `.gitignore` is missing while `.env` exists beside project files - deferred because adding repo policy files was outside the approved safe-fix list for this pass.
- P1 - Project root - no package manifest, tests, routes, DB migrations, or deploy config exist - deferred because creating application structure is not a small surgical safe fix.