Audit overview — 2026-11-03

Every route of the marketing site, brand portal, tenant storefront and admin console, plus 47 screens of the iOS app, captured on a local machine from the current branches and again against production. This page is the summary; the findings page has every item with its verdict and the fix plan turns them into ordered work.

Download the report

The full report is a single self-contained HTML file (about 7 MB) with every capture embedded, click-to-enlarge, findings tables with local-versus-production verdicts, and the mobile tour.

Download the report (HTML)   Open in the browser

Data and tooling behind it:

• summary-local.json and summary-prod.json — per-route facts, diagnostics and findings for each environment
• compare.json — the paired verdicts and route differences
• Tooling: crawl.js, report.js, compare.js, build-artifact.js, config.json, config-prod.json, audit-tour.yaml and run-maestro-audit.sh

Full-resolution PNGs (about 560 MB) stay on the machine that ran the audit; the report's captures are compressed copies.

What was audited

Surface	Local build	Production host	Routes	Captures (local / prod)
Marketing site	Drape-Marketing main 444e4f1 on localhost:3003	drape.to	10	41 / 41
Brand portal	Drape-brand main f8fe441 on brand.localhost:3005	brand.drape.to	38	103 / 68
Tenant storefront	same app on qa-atelier.localhost:3005	checkthefeed.drape.to	11	40 / 25
Admin console	Drape-admin-v1 main 35dedc7 on admin.localhost:3004	admin.drape.to	23	31 / 27
iOS app	Drape- develop 9986a240, Release build, iPhone 15 Pro simulator, dev API	not run	47 screens	51 / —

The web apps called dev-api.drape.to locally; the marketing site calls api.drape.to by default in both environments. Signed-in areas were not covered: 20 brand-portal and 21 admin routes exist but redirect to login, and no working test account exists in the repos or docs. The mobile pass used a throwaway consumer account created on the dev backend.

Scorecard

Verdict	Count	Items
Real in production	4	Privacy and Terms 404 on drape.to; product share image missing; admin wrong-password reloads silently; featured-products endpoint 500
Hygiene, both environments	4	Committed test credentials; missing h1 and main landmarks; production brand 404 page has no title; lazy hero images
Dev environment only	5	CORS on plain localhost ports; hydration warning; Stripe not configured on dev; dev seed data; stale Maestro flows
Expected from probes	20+	4xx responses to deliberately invalid tokens, wrong passwords and unknown routes

The short version

1. drape.to/privacy and /terms are 404 in production. The files are deployed (/privacy.html works) but the Next rewrite is not active on the host. The marketing config names these as the App Store Connect canonical URLs, and every marketing footer links to them.
2. Product share pages lose their image in production (and crash locally) because next/image has no allowed remote hosts; all production product images live on v3b.fal.media or Supabase storage.
3. A wrong admin password silently reloads the login page with an emptied email, locally and on admin.drape.to. The brand portal handles the same case correctly.
4. /api/products/featured returns 500 on dev and prod; the app masks it as an empty "no featured drops" state.
5. The iOS app holds up across 47 screens: validation copy, onboarding, every tab, seller hub, legal pages and sensible fallbacks for deep links opened without parameters.
6. Everything else is either dev-environment plumbing or one-line hygiene in a shared layout. See the fix plan.