# Audit overview — 2026-11-03

Every route of the marketing site, brand portal, tenant storefront and admin
console, plus 47 screens of the iOS app, captured on a local machine from the
current branches and again against production. This page is the summary; the
[findings](./findings.md) page has every item with its verdict and the
[fix plan](./fix-plan.md) turns them into ordered work.

## Download the report

The full report is a single self-contained HTML file (about 7 MB) with every
capture embedded, click-to-enlarge, findings tables with local-versus-production
verdicts, and the mobile tour.

<p>
  <a className="button button--primary button--lg" href="/audits/2026-11-03/drape-site-audit.html" download="drape-site-audit-2026-11-03.html">Download the report (HTML)</a>
  &nbsp;
  <a className="button button--secondary button--lg" href="pathname:///audits/2026-11-03/drape-site-audit.html">Open in the browser</a>
</p>

Data and tooling behind it:

- [summary-local.json](pathname:///audits/2026-11-03/summary-local.json) and
  [summary-prod.json](pathname:///audits/2026-11-03/summary-prod.json) — per-route
  facts, diagnostics and findings for each environment
- [compare.json](pathname:///audits/2026-11-03/compare.json) — the paired verdicts
  and route differences
- Tooling: [crawl.js](pathname:///audits/2026-11-03/tooling/crawl.js),
  [report.js](pathname:///audits/2026-11-03/tooling/report.js),
  [compare.js](pathname:///audits/2026-11-03/tooling/compare.js),
  [build-artifact.js](pathname:///audits/2026-11-03/tooling/build-artifact.js),
  [config.json](pathname:///audits/2026-11-03/tooling/config.json),
  [config-prod.json](pathname:///audits/2026-11-03/tooling/config-prod.json),
  [audit-tour.yaml](pathname:///audits/2026-11-03/tooling/audit-tour.yaml) and
  [run-maestro-audit.sh](pathname:///audits/2026-11-03/tooling/run-maestro-audit.sh)

Full-resolution PNGs (about 560 MB) stay on the machine that ran the audit; the
report's captures are compressed copies.

## What was audited

| Surface | Local build | Production host | Routes | Captures (local / prod) |
| --- | --- | --- | --- | --- |
| Marketing site | `Drape-Marketing` main `444e4f1` on `localhost:3003` | `drape.to` | 10 | 41 / 41 |
| Brand portal | `Drape-brand` main `f8fe441` on `brand.localhost:3005` | `brand.drape.to` | 38 | 103 / 68 |
| Tenant storefront | same app on `qa-atelier.localhost:3005` | `checkthefeed.drape.to` | 11 | 40 / 25 |
| Admin console | `Drape-admin-v1` main `35dedc7` on `admin.localhost:3004` | `admin.drape.to` | 23 | 31 / 27 |
| iOS app | `Drape-` develop `9986a240`, Release build, iPhone 15 Pro simulator, dev API | not run | 47 screens | 51 / — |

The web apps called `dev-api.drape.to` locally; the marketing site calls
`api.drape.to` by default in both environments. Signed-in areas were not
covered: 20 brand-portal and 21 admin routes exist but redirect to login, and no
working test account exists in the repos or docs. The mobile pass used a
throwaway consumer account created on the dev backend.

## Scorecard

| Verdict | Count | Items |
| --- | --- | --- |
| Real in production | 4 | Privacy and Terms 404 on `drape.to`; product share image missing; admin wrong-password reloads silently; featured-products endpoint 500 |
| Hygiene, both environments | 4 | Committed test credentials; missing `h1` and `main` landmarks; production brand 404 page has no title; lazy hero images |
| Dev environment only | 5 | CORS on plain localhost ports; hydration warning; Stripe not configured on dev; dev seed data; stale Maestro flows |
| Expected from probes | 20+ | 4xx responses to deliberately invalid tokens, wrong passwords and unknown routes |

## The short version

1. **`drape.to/privacy` and `/terms` are 404 in production.** The files are
   deployed (`/privacy.html` works) but the Next rewrite is not active on the
   host. The marketing config names these as the App Store Connect canonical
   URLs, and every marketing footer links to them.
2. **Product share pages lose their image in production** (and crash locally)
   because `next/image` has no allowed remote hosts; all production product
   images live on `v3b.fal.media` or Supabase storage.
3. **A wrong admin password silently reloads the login page** with an emptied
   email, locally and on `admin.drape.to`. The brand portal handles the same
   case correctly.
4. **`/api/products/featured` returns 500** on dev and prod; the app masks it as
   an empty "no featured drops" state.
5. The iOS app **holds up across 47 screens**: validation copy, onboarding,
   every tab, seller hub, legal pages and sensible fallbacks for deep links
   opened without parameters.
6. Everything else is either dev-environment plumbing or one-line hygiene in a
   shared layout. See the [fix plan](./fix-plan.md).