`trademarks-copyright/rereview.md`

29 lines
## Verdict
FIX BEFORE SHIP

## Patches reviewed
src/app/api/drops/cron/route.ts:14 — missing cron secret failed open — now returns 503 when `CRON_TOKEN` is unset — good

src/app/api/drops/checkout/route.ts:7 — `null`/non-object JSON could reach property reads — object guard added before use — good

src/app/api/drops/send/route.ts:17 — `null`/non-object JSON could reach handler logic — object guard added before use — good

src/app/api/drops/compose/route.ts:10 — `null`/non-object JSON could reach handler logic — object guard added before use — good

src/app/api/brands/hunt/route.ts:14 — `null`/non-object JSON could reach SSE setup — object guard added before use — good

src/app/api/drops/drop-items/[id]/route.ts:17 — `null`/non-object JSON could reach `in body` checks — object guard added before use — good

src/app/api/drops/admin/subscribers/[id]/route.ts:13 — `null`/non-object JSON could reach `in body` checks — object guard added before use — good

## New issues introduced
none observed.

## Missed call-sites (same problem elsewhere)
src/app/api/swot/route.ts:9 — same `req.json().catch(() => ({}))` pattern still allows JSON `null` to throw at `body.itemId`.

src/app/api/drops/signup/route.ts:9 — same `req.json().catch(() => ({}))` pattern still allows JSON `null` to throw at `body.email`.

## Recommendations
- Add the same non-null object guard to `swot` and `signup`.
- Consider replacing repeated inline guards with a small shared JSON-object parser later, but the immediate fix can stay surgical.