Review A: Add REVIEW.md — code review findings

[davidpomerenke]

Summary

Adds REVIEW.md with a comprehensive code review of the current codebase.

Key findings

Critical security issues:

• POST /api/export/entities has no authentication check — any unauthenticated internet user can download a formatted Excel export
• Entity confirmation DELETE (/api/entity-confirmations) has no confirmed_by_user_id filter — any user of entity X can delete confirmations created by other users of entity X
• isQuerySafe() in src/lib/chat-tools.ts uses \bpg_\b regex which never matches (underscore is a word character) — pg_read_file etc. pass through
• readDocument() in src/lib/chat-tools.ts uses the main admin DB pool instead of the restricted chatQuery connection
• sql/auth_tables.sql is out of sync: still defines role column dropped by migration 007; admin_emails table missing

Documentation gaps:

• README describes the generic boilerplate only — no mention of the actual app features, Python pipeline, vector search, or entity confirmation workflow
• Fresh DB provisioning order is undocumented (requires running 6+ SQL files in a specific order)
• DATABASE_URL_CHAT env var referenced in code but not in any env template

Test plan

• Verify /api/export/entities requires no auth (curl without cookie)
• Verify entity confirmation DELETE does not scope to confirmed_by_user_id
• Test isQuerySafe('SELECT pg_read_file(...)') returns true (should be false)

🤖 Generated with Claude Code

---

Generated by Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
un80-sg-reports-survey	Ready	Preview, Comment	Jun 19, 2026 6:16am