`CHANGES.md`

22 lines
## Applied
- src/app/api/drops/cron/route.ts:14 — require `CRON_TOKEN` to be configured before accepting cron requests — prevents the reviewed fail-open cron path when the env secret is missing.
- src/app/api/drops/checkout/route.ts:7 — return 400 when the parsed JSON body is `null` or non-object — prevents malformed JSON values from becoming handler errors.
- src/app/api/drops/send/route.ts:17 — return 400 when the parsed JSON body is `null` or non-object — prevents malformed JSON values from becoming handler errors.
- src/app/api/drops/compose/route.ts:10 — return 400 when the parsed JSON body is `null` or non-object — prevents malformed JSON values from becoming handler errors.
- src/app/api/brands/hunt/route.ts:14 — return 400 when the parsed JSON body is `null` or non-object — prevents malformed JSON values from becoming handler errors.
- src/app/api/drops/drop-items/[id]/route.ts:17 — return 400 when the parsed JSON body is `null` or non-object — prevents malformed JSON values from becoming handler errors.
- src/app/api/drops/admin/subscribers/[id]/route.ts:13 — return 400 when the parsed JSON body is `null` or non-object — prevents malformed JSON values from becoming handler errors.

## Deferred (needs Steve)
- P0 — package.json:18, src/middleware.ts:14 — vulnerable Next middleware auth bypass — deferred because package upgrades/edge blocking were outside the safe fix list.
- P0 — src/app/api/drops/send/route.ts:15, src/app/api/drops/compose/route.ts:8, src/app/api/score/route.ts:9, src/app/api/brands/hunt/route.ts:12 — public operational mutation routes — deferred because route auth design is broader than a surgical safe fix.
- P0 — src/app/api/drops/drop-items/[id]/route.ts:8 — public PATCH can edit newsletter content — deferred because moving/enforcing admin auth changes route structure and access policy.
- P0 — src/app/api/drops/checkout/route.ts:23 — Stripe-disabled checkout can directly upgrade subscribers — deferred because billing fallback/session policy needs owner decision.
- P0 — .env.local:30, .env.local:47-48 — plaintext admin/basic credentials — deferred because real secret rotation must be done by Steve; `.env.local` was left untouched.
- P0 — .env.local:25 — placeholder cron token — deferred because rotation of the real token must be done by Steve.
- P1 — src/app/api/drops/send/route.ts:43, src/app/api/drops/send/route.ts:85, src/lib/drops.ts:381 — transient email failures mark deliveries bounced — deferred because retry semantics/data handling are not in the safe list.
- P1 — src/lib/drops.ts:197, src/lib/drops.ts:233 — compose race without transaction/lock — deferred because transaction/locking behavior is beyond the approved safe fixes.
- P1 — src/app/api/drops/admin/subscribers/[id]/route.ts:18 — subscriber values are not enum/range validated — deferred because validation rules need owner-approved state constraints.
- P1 — src/lib/brandHunter.ts:283, src/app/api/brands/hunt/route.ts:18 — caller controls seeds/cap — deferred because auth/resource policy changes are broader than the safe body guard applied.
- P1 — src/lib/email.ts:96 — file email fallback writes recipient HTML under `/tmp/drops` — deferred because production email-backend policy needs Steve.