`CHANGES2.md`

7 lines
## Round 2 Applied
- src/app/api/swot/route.ts:10 — added a non-null object/array guard before reading `body.itemId` and `body.force` — fixes CODEX_REREVIEW.md missed call-site for JSON `null` reaching `body.itemId`.
- src/app/api/drops/signup/route.ts:10 — added a non-null object/array guard before reading `body.email`, `body.name`, and `body.ref` — fixes CODEX_REREVIEW.md missed call-site for JSON `null` reaching `body.email`.

## Still Deferred
- Prior owner/security-policy items already listed in CHANGES.md remain deferred for Steve; CODEX_REREVIEW.md reported no new introduced issues beyond the two safe missed call-sites fixed above.