`stayclaim/rereview.md`

20 lines
## Verdict
FIX BEFORE SHIP

## Patches reviewed
`scripts/filmla-cpra-followup.sh:16` — hardcoded Basic Auth secret — now reads `FILMLA_GEORGE_BASIC_AUTH` — STATUS concern  
`scripts/filmla-cpra-followup.sh:41` — silent missing credentials — now fails fast — STATUS broken  
`.env.example:5` — undocumented required secret — placeholder added — STATUS good  
`src/app/search/page.tsx:42` — unsafe snippet HTML rendering — literal `<mark>` parser added — STATUS good  
`src/app/search/page.tsx:144` — `dangerouslySetInnerHTML` on search snippets — replaced with React-rendered content — STATUS good

## New issues introduced
`scripts/filmla-cpra-followup.sh:41` — launchd/non-interactive runs will not automatically load `.env.example` or shell profile vars, so the scheduled CPRA follow-up now exits before checking/sending unless the launchd job is separately updated with `FILMLA_GEORGE_BASIC_AUTH` — severity P1

## Missed call-sites (same problem elsewhere)
`.env.local.example:1` — env template used for local setup still lacks `FILMLA_GEORGE_BASIC_AUTH`  
`.env.production.example:1` — production env template still lacks `FILMLA_GEORGE_BASIC_AUTH`

## Recommendations
- Add the secret to the actual launchd environment or have the script source a secure, local-only env file before the line 41 check.
- Add the placeholder to the other env templates so setup paths do not diverge.