`CHANGES.md`

20 lines

## Applied
- `scripts/filmla-cpra-followup.sh:16` — removed the hardcoded Basic Auth credential and read it from `FILMLA_GEORGE_BASIC_AUTH` — prevents source exposure of the Gmail HTTP agent password.
- `scripts/filmla-cpra-followup.sh:41` — added a fail-fast check when `FILMLA_GEORGE_BASIC_AUTH` is missing — avoids silently calling the agent without required credentials.
- `.env.example:5` — added a placeholder for `FILMLA_GEORGE_BASIC_AUTH` — documents the required secret without copying the real value.
- `src/app/search/page.tsx:42` — added a small snippet renderer that treats only literal `<mark>` tokens as markup — preserves highlights while letting React escape OCR/source text.
- `src/app/search/page.tsx:144` — replaced `dangerouslySetInnerHTML` with React-rendered snippet content — removes the stored DOM injection path flagged for search results.

## Deferred (needs Steve)
- P0 — `.env.local:4` — real Google Maps browser key exists in the workspace — needs key rotation, referrer restrictions, quotas, and `.env.local` handling outside this safe patch.
- P0 — `scripts/filmla-cpra-followup.sh:15` — Gmail agent still uses a plain HTTP tailnet URL and the removed credential still needs rotation — requires Steve’s secret rotation and network/Tailscale decision.
- P0 — `src/app/admin/layout.tsx:45` — `/admin/*` is explicitly unauthenticated — auth/proxy policy is larger than the allowed safe fixes.
- P0 — `src/app/dashboard/page.tsx:11` — `?email=` acts as authentication — requires product/auth flow changes.
- P0 — `package.json:17` — Next version is below the reviewed patched version — package version bumps are out of scope.
- P1 — `src/app/claim/[slug]/page.tsx:34` — claim form has no submission path — feature behavior change, not in safe list.
- P1 — `src/app/search/page.tsx:44` — server fetch trusts the incoming `Host` header — not in safe list; needs routing/search architecture decision.
- P1 — `src/app/api/search/route.ts:47` — no max query length before DB fanout — validation policy change, not in safe list.
- P1 — `scripts/extract-news-addresses.ts:212` — delete/insert/mark flow lacks transaction/advisory lock — transaction/concurrency change deferred.
- P1 — `src/app/admin/data/page.tsx:217` — filter DB errors are swallowed — admin UX/reporting decision deferred.
- P1 — `package.json:12` — `ingest:airbnb` points to a missing script — command removal/restoration decision deferred.