Audit · magisph/rv-adv

Verdict

Readiness verdict

High commercial potential from a defensible niche (Brazilian judiciary scraping) and active development (30 commits/90d), but 9 of 11 audit dimensions are missing—license, auth, billing, multi-tenancy, email, observability, privacy, security, deploy, and unit economics—making it far from production-ready. No tests or CI signal fragility; solo maintainer raises bus-factor risk.

Primary risk

Single maintainer with no tests, CI, or license threatens reliability and blocks commercial use; missing auth and billing make charging impossible.

Audit items

auth

missing

Evidence: evidence_flags.auth: missing; no auth logic in package.json or sources; Supabase client used only for database access, no sign-up/sign-in UI.

Remediation: Implement Supabase Auth with email/password and Row Level Security policies on all tables.

billing

missing

Evidence: evidence_flags.billing: missing; no Stripe or payment dependencies in package.json.

Remediation: Integrate Stripe Billing with metered usage for scraping API calls and subscription tiers.

multi_tenancy

missing

Evidence: evidence_flags.multi_tenancy: missing; no organization or firm_id column visible in sampled files; README mentions 'Gestão de Clientes' but no data model for firm isolation.

Remediation: Add a `firm_id` to all user-related tables and enforce cross-firm isolation via Supabase Row Level Security.

missing

Evidence: evidence_flags.email: missing; no SendGrid/Mailgun deps; Supabase email templates not configured.

Remediation: Configure Supabase email templates for magic link auth and use SendGrid for transactional notifications.

observability

missing

Evidence: evidence_flags.observability: missing; no logging library or error tracking service in dependencies.

Remediation: Integrate Sentry for frontend/backend error tracking and add structured logging with pino.

docs

present

Evidence: README includes system topology, module descriptions, and tech stack; evidence_flags.docs: present.

Remediation: Add a self-hosted deployment guide and OpenAPI spec for the scraping API.

privacy

missing

Evidence: No privacy policy, data handling documentation, or LGPD consent mechanism in the codebase; evidence_flags.env_example missing suggests no standardized data protection configurations.

Remediation: Draft a privacy policy covering LGPD, add cookie consent to the frontend, and document data retention practices.

security

missing

Evidence: No Helmet middleware, no CSP, no npm audit in CI, no .env.example; evidence_flags.env_example: missing.

Remediation: Add Helmet, enforce strict CSP, create .env.example, and enable automated vulnerability scanning in GitHub Actions.

deploy

missing

Evidence: No Dockerfile, fly.toml, or Render configuration; evidence_flags.deploy: missing; package.json lacks production start script.

Remediation: Containerize with Docker, configure Fly.io deployment, and add a production start command.

unit_economics

missing

Evidence: No billing or cost-tracking code; evidence_flags.billing: missing; no usage metrics or plan definitions.

Remediation: Define pricing tiers (e.g., per lawyer/month, per 1000 case retrievals) and instrument the scraping service to track consumption for metering.

Fix first

Remediation priorities

Critical gaps

No open-source license — cannot redistribute or offer commercially.
No authentication — users cannot sign in or secure data.
No billing integration — no way to charge for the service.
No automated tests or CI — critical scraping logic is fragile and untested.
No deployment pipeline — cannot ship a hosted version.

Quick wins

Add an MIT license (create LICENSE file).
Create .env.example with required Supabase keys.
Add a health check endpoint at /api/health.
Write a basic integration test for the TRF5 scraping endpoint using supertest.
Set up GitHub Actions workflow for linting and running that single test.

Shared with Git Pitcher

This webpage is a public artifact generated from a repository. Git Pitcher turns repos into Repo Reads, Audits, and Build Packs you can actually use with an AI coding agent.

Analyze your own repo →Generate a Build Pack →