Drape Site Audit

What stands out

1. Marketing · in productionPrivacy and Terms return 404 on drape.to. Local serves /privacy and /terms through a rewrite to the HTML files. Production serves /privacy.html but not the clean URL, so the rewrite is not active on the host. Every marketing page footer links to the clean URLs, and the config comment names them as the App Store Connect canonical URLs. Seen only in production; not reproducible locally.
2. Marketing · in productionProduct share pages lose their image in production and crash locally. Production renders the product (FEED Corduroy Jacket) but the image optimizer refuses the fal.media host with a 400, leaving an empty frame with alt text. Locally the same missing next/image remotePatterns entry throws a runtime error instead. One fix covers both: allow v3b.fal.media and the Supabase storage host in Drape-Marketing/next.config.ts.
3. Admin · in productionA wrong admin password silently reloads the login page. The API answers 401 with "Invalid admin credentials", but the admin API client redirects to /login on every 401, including the login request itself, so the page reloads with no message and an emptied email field. Reproduced locally and on admin.drape.to. The brand portal gets this right and shows "Invalid email or password"; an earlier draft of this report blamed both portals, which was an artifact of a malformed probe address.
4. Mobile app · dev buildThe app holds up across 47 screens. Signup and login both validate empty submits with clear copy, onboarding runs welcome → culture → style → body profile, every tab and seller-hub screen renders, and the legal pages load. Deep links opened without their parameters fall back sensibly (look board asks for a username, save-closet and checkout-return explain what is missing). Brand routes fall back to home for a consumer account. The camera screen detects the simulator and offers a manual path.
5. Mobile app · dev onlySeller billing says Stripe is not configured. The committed dev task definition injects no STRIPE_* secrets, while task-def-prod.json injects all seven, so this is a dev-environment gap rather than a product bug. The uncommitted change to task-def-dev.json in your working tree adds exactly those secrets.
6. Mobile app · dev dataDev seed data hides a backend error. Both QA Atelier products (Ink Wide Trousers, Cream Oversized Shirt) show a wakeskate photo, and the Featured screen shows an empty state while the featured endpoint is returning 500 on both environments, so the app is masking that failure as "no featured drops".
7. Repo QAThe committed Maestro flows no longer match the app. 01-signup fails at its second step and the brutal-audit flow expects a login path that moved. A replacement tour flow that matches the current screens is saved in audits/2026-11-03/flows/audit-tour.yaml and runs in about 12 minutes against a Release simulator build.
8. Backend · both environmentsThe featured-products endpoint returns 500. /api/products/featured answered Internal server error on dev-api.drape.to and api.drape.to when called directly during route discovery.
9. Repo hygieneA test account password is committed in four files. kcb1099@gmail.com with its password appears in CHANGELOG_ENGINEERING.md, PROD_ENV_TEMPLATE.md, ENVIRONMENT_RECOVERY_PLAYBOOK.md and qa/maestro/rc1_gate.yaml. The credentials no longer work, but the pattern contradicts the repo's own secrets policy; move test credentials to environment variables and purge the lines.
10. All surfaces · both environmentsHeading and landmark hygiene is a pattern, not a one-off. Around 20 signed-out brand-portal and storefront pages have no h1 and roughly 36 pages across the four surfaces have no <main> landmark, identically in production. The production brand app's 404 page also has no title and no heading, where the local build has both, so production is behind the develop branch there. These live in shared layouts, one fix per app.
11. Local only · dev nice-to-havePlain localhost ports 3004 and 3005 are blocked by the dev API. The CORS allowlist accepts localhost only on 3000 to 3003, plus any *.localhost host. Use brand.localhost and admin.localhost, and update start-drape-local.sh to open those hosts. Not a production issue.
12. Local only · dev nice-to-haveHydration mismatch warning on the brand landing page. The inline theme script sets data-theme before React hydrates. Production React strips this warning, so it cannot be observed on brand.drape.to, but the mismatch is still in the code. suppressHydrationWarning on <html> clears it.
13. Local only · dev nice-to-haveDev-server warnings about lazy hero images. Next flags the hero image on marketing / and /for-brands and on the brand landing as the Largest Contentful Paint without loading="eager". The warning only prints in dev; the lazy-loading behaviour is the same in production and is a cheap first-paint win.
14. StorefrontLive storefronts only exist in production. checkthefeed.drape.to renders CHECKtheFeed's shop; dev has no store with a resolvable slug, so the local storefront, door landing (/l) and QR product page (/p) could only be captured in their not-found states. Those states match production. The tenant root / redirects to the portal login in both environments, which is where a shopper on a brand subdomain lands.
15. MarketingProduction is behind the develop branch. The /download page heading differs (production "BE FIRST TO TRY DRAPE", local "DOWNLOAD DRAPE") and the brand app's 404 page differs, so the deployed marketing and brand builds predate the local checkouts listed above. The brand landing's full-page capture also shows a tall blank band where the GSAP ScrollTrigger-pinned RackCinema section sits; that is the pin spacer, not a rendering bug.