`lawyer-directory-builder/rereview.md`

26 lines
## Verdict
FIX BEFORE SHIP

## Patches reviewed
.env.example:1 — placeholder-only env template — no real secret values observed — STATUS good  
src/server/portal.ts:352 — signup missing-body 500 — guard added before destructuring — STATUS good  
src/server/portal.ts:391 — login missing-body 500 — guard added before destructuring — STATUS good  
src/server/portal.ts:534 — admin plan missing-body 500 — guard added before `req.body.plan` — STATUS good  
src/server/leads.ts:186 — public lead missing-body 500 — guard added before body reads — STATUS good  
src/server/leads.ts:337 — admin lead updates missing-body 500 — guards present for status and notes routes — STATUS good  
src/server/directory.ts:468 — directory inquiry missing-body 500 — guard added before body reads — STATUS good  
src/server/upgrade.ts:149 — checkout missing-body 500 — guard added before body reads — STATUS good  
src/server/upgrade.ts:314 — order status missing-body 500 — guard added before `req.body.status` — STATUS good  
src/enrich/site_audit.ts:268 — Playwright browser leak on worker failure — `finally` closes browser — STATUS good  
src/scripts/click_through.ts:30 — smoke-test browser leak — `finally` closes browser — STATUS good  
src/scripts/probe_calbar.ts:14 — probe browser leak — `finally` closes browser — STATUS good  
src/scripts/create_admin.ts:18 — CLI password exposure — env lookup added; no broken imports observed — STATUS good

## New issues introduced
none observed.

## Missed call-sites (same problem elsewhere)
src/server/data_market.ts:319 — same unguarded `req.body` pattern still present; malformed/missing body reaches `const kind = ... b.kind ...` and can 500.

## Recommendations
- Add the same malformed/missing body guard to `POST /data/checkout` before line 321.