`site-factory/rereview.md`

22 lines
## Verdict
FIX BEFORE SHIP

## Patches reviewed
admin/server.js:15 — hardcoded `SESSION_SECRET` fallback — now requires 32+ char env; PM2 supplies 97-byte `admin/.session-secret` via ecosystem.config.js:50 — STATUS good  
admin/server.js:139 — admin bound to public interfaces — now binds `127.0.0.1` — STATUS good  
admin/.env.example:14 — weak session placeholder — now documents a 32+ char placeholder — STATUS good  
sites/wholivedthere.com/app/app/api/webhook/stripe/route.ts:11 — unsigned live webhook accepted when Stripe config missing — source now 500s in production, but live `.next` artifact is stale — STATUS broken  
sites/bubbesblock.com/app/app/api/webhook/stripe/route.ts:11 — same webhook issue — source now guarded, but live `.next` artifact is stale — STATUS broken  
sites/claimmyaddress.com/app/app/api/webhook/stripe/route.ts:11 — same webhook issue — source now guarded, but live `.next` artifact is stale — STATUS broken  

## New issues introduced
none observed.

## Missed call-sites (same problem elsewhere)
sites/wholivedthere.com/app/.next/server/app/api/webhook/stripe/route.js:4 — compiled route still returns `{ received: true, stub: true }` when Stripe or webhook secret is missing.  
sites/bubbesblock.com/app/.next/server/app/api/webhook/stripe/route.js:4 — compiled route still returns `{ received: true, stub: true }` when Stripe or webhook secret is missing.  
sites/claimmyaddress.com/app/.next/server/app/api/webhook/stripe/route.js:4 — compiled route still returns `{ received: true, stub: true }` when Stripe or webhook secret is missing.  

## Recommendations
- Rebuild all three Next apps before restart/deploy; ecosystem.config.js:58-84 runs `next start`, so production uses `.next/server`, not the patched source directly.
- Add a deploy/build check that fails if `.next/server/app/api/webhook/stripe/route.js` still contains the unconditional stub return.