11 · Gaps & audit status
Honest scoreboard so we develop the right things in the right order. Living detail: AUDIT-FINDINGS.md.
Fixed (do not re-litigate without re-verify)
- Nginx
/media/for platform catalog images - SQL parameterized queries (flagged files)
- Device auth secrets for kiosk/mobile routers
- Session secret + Secure cookie + file perms
- Legacy payments router disabled
- Auth middleware log noise → logger.debug
- Master-admin mutation audit events
- HR admin role gates + benefits IDOR lockdown
- Bare
/apiunscoped auth on maintenance/bi/billing/financial kitchen_ticketsensure-if-missing
Still open
| Item | Type | Priority class |
|---|---|---|
Parallel routes/api/* router tree (S11-10) | Architecture debt | Careful cleanup project |
| Frontend Vite-in-production | Ops maturity | Medium |
| Offline service worker disabled | Reliability | Medium |
| KDS → signage live board | Roadmap feature | Product |
| Inventory field UI (isConsumable, weight/volume) | Product depth | Tier 3 |
| Unit field design reconciliation | Schema clarity | Tier 3 |
| Register ceremony for solo operators | ICP / UX | Validate with users |
| Gift cards / loyalty full E2E re-verify | Verification | Before big promo clients |
| Timeclock arbitrary staffId | Integrity | Trace UI first |
| Analytics vs main DB report reconciliation | Correctness | Medium |
| ICP workbook unfilled | Strategy | Non-code workshop |
| No version control on live box | Process risk | gperep now |
Recurring product pattern
Capable backend · thin default UI
Seen in inventory units, weight fields, isConsumable, register ceremony weight for small tenants.
Prefer completing UI / toggles over rewriting services.