Audit · magisph/rv-adv

Verdict

Readiness verdict

Low commercial readiness due to missing auth, billing, multi-tenancy, observability, tests, deploy, and license. Active development (30 commits in 90 days) and a documented architecture show momentum, but the repo lacks fundamental SaaS infrastructure and customer validation.

Primary risk

Single maintainer without tests or CI threatens reliability for paying customers; no license blocks any commercial use.

Audit items

auth

missing

Evidence: evidence_flags.auth: missing; no auth implementation in package.json or source reviewed; Supabase client imported but no Auth UI or logic visible.

Remediation: Implement Supabase Auth with email/password and Row Level Security policies for tenant isolation.

billing

missing

Evidence: No billing integration; evidence_flags.billing: missing; no Stripe or payment code in package.json.

Remediation: Integrate Stripe Billing with metered usage for scraping API calls.

multi_tenancy

missing

Evidence: No tenant isolation logic; evidence_flags.multi_tenancy: missing; README mentions 'Gestão de Clientes' but no database schema for firms.

Remediation: Add firm_id to all tables and enforce Row Level Security on Supabase to segregate client data.

missing

Evidence: No email service integration; evidence_flags.email: missing; no sendgrid/mailgun deps.

Remediation: Configure Supabase email templates for passwordless login and notifications.

observability

missing

Evidence: No logging or monitoring; evidence_flags.observability: missing; no error tracking deps.

Remediation: Integrate Sentry for error tracking and add structured logging with pino.

docs

present

Evidence: README with architecture, module descriptions, and technologies; evidence_flags.docs: present.

Remediation: Add API reference and self-hosted deployment guide.

security

missing

Evidence: No Helmet or CSP headers; evidence_flags.env_example missing; no npm audit in CI.

Remediation: Add Helmet middleware, enable npm audit in GitHub Actions, and enforce strict Content Security Policy.

deploy

missing

Evidence: No CI/CD configuration; evidence_flags.deploy: missing; no Dockerfile, fly.toml, or vercel.json.

Remediation: Create Dockerfile and fly.toml for deployment on Fly.io, wired to GitHub Actions.

Fix first

Remediation priorities

Critical gaps

No open-source license (license: missing) — cannot redistribute or offer commercially.
No authentication (auth: missing) — users cannot sign in or secure data.
No billing integration (billing: missing) — no way to charge for the service.
No automated tests (tests: missing) — critical scraping logic is untestable and fragile.
No deployment pipeline (deploy: missing) — no way to ship the hosted app.

Quick wins

Add an MIT license (create LICENSE file in root).
Create .env.example with required Supabase keys.
Add a simple health check endpoint at /api/health.
Write a single integration test verifying TRF5 scraping response using supertest.
Set up GitHub Actions workflow for linting and running that single test.

Shared with Git Pitcher

This webpage is a public artifact generated from a repository. Git Pitcher turns repos into Repo Reads, Audits, and Build Packs you can actually use with an AI coding agent.

Analyze your own repo →Generate a Build Pack →