# Production audit — 2026-10-06

V2 (`justice-choice2.zip`) is the base. `VERSION-COMPARISON.json` records every shared file's original SHA-256, all changes and additions. `AUDIT-SCAN.json` records the initial text scan. Existing `.env`, databases and uploaded files are outside the release and must not be replaced.

## Findings before implementation

- V1-only production Compose, deployment, verification and manifest files are missing. Restore configuration intent; do not reuse old test results or hashes.
- V2 preserves lawyer enquiry overview/filter/search/pagination and password visibility inputs. Preserve these components and API queries.
- Compose migrates **and seeds**; the Node image defaults to production, while `.env` can override it. Production needs explicit enforced mode, private DB/cache, fail-closed secrets, migration-only startup and health checks.
- Local scripts ignore their port override. Browser-facing public variables in Next builds need explicit build arguments, not only runtime environment.
- Demo passwords appear in seed output, login UI, scripts and README. Demo fixtures need explicit opt-in, development/test mode and isolation. Reset currently has a production bypass.
- Password/email change allows missing current password for privileged users. Email is immediately replaced before verification. Implement pending verified changes with transaction-safe single-use confirmation and session revocation.
- Existing authentication includes scrypt, server sessions, lockouts, TOTP, hashed tokens/recovery codes and expiry. Security change mail exists. Strengthen challenge invalidation and new-device alerts rather than rebuilding auth.
- Role guards exist server-side and protect leads from editors/verifiers. Add explicit capabilities for sensitive operations without a permission-management UI.
- Uploads already use magic bytes, size limits, random keys, private evidence access and path containment. Missing extension/MIME matching, malware checks, fail-closed scanning and failed-index cleanup.
- Organic ranking pipeline does not read payments/subscriptions. Existing version activation lacks preview/approval. Add governance and safe rollback while retaining weights/history.
- Existing corrections handle public data disputes but do not provide a structured professional ranking appeal. Reuse existing verification patterns.
- Direct routing is scoped to the selected lawyer. Concurrent generic routing can exceed recipient limits; serialize routing by enquiry.
- Advanced enquiry searches need target/user/delivery indexes and selective trigram indexes. Use forward migrations; do not rewrite V2 migrations.
- Public firm offices are inferred from lawyer locations, ignoring explicit office addresses/contact details. Add sanitized actual offices without exposing organization metadata.
- Existing email is queued and non-destructive on failure. Raw transport errors and an unused console-mail provider can leak data; sanitize failure details and remove only proven unused code.
- Queue retries and graceful worker shutdown exist. Add durable worker heartbeat/job outcomes and authorized health details; do not claim backups are configured.
- Import preserves raw provenance and normalized data but requires input bounds/type validation. Existing Stripe idempotency/signatures and outbound webhook DNS checks are retained; IPv6 mapped/reserved ranges need hardening.
- Existing client export, saves, enquiries and deletion exist. Preserve retained accounting/audit records and document operator retention duties.
- SEO eligibility, robots, sitemap segmentation and JSON-LD exist. Add Terms/disclosures using current legal-page layout.
- Regression scripts use incorrect relative imports and are outside CI. Run them only against disposable databases and wire them into verification.

## Verification policy

Use fresh isolated Docker projects/databases. Never reset or seed the existing running stack. Record actual commands and outcomes in `VERIFICATION.md`; external Stripe/SMTP/S3/Search Console/DNS tests require separate credentials. No claim of complete security or bug-free operation follows from compilation.