@the-bearded-bear/claude-craft 8.21.0 → 8.22.0

package/Dev/i18n/base/Vercel/checklists/new-feature.md

@@ -0,0 +1,75 @@
+# Vercel New Feature Checklist
+
+> Covers adding a new Serverless Function, Cron Job, or platform-level config change. For the framework running on top of Vercel (Next.js, etc.), see that stack's own new-feature checklist — this covers **only** the Vercel-platform surface.
+
+## Before Starting
+
+- [ ] **Requirements clear** - expected behavior and acceptance criteria defined
+- [ ] **Project shape identified** - static+rewrites / Serverless Functions / ISR-enabled / Cron+Scheduled (see `02-architecture-vercel.md`)
+- [ ] **Ownership checked** - if a claude-craft framework stack already owns routing/caching for this concern, defer to it rather than adding a competing `vercel.json` entry (see the decision tree in `02-architecture-vercel.md`)
+
+## Runtime Decision
+
+- [ ] **Node.js runtime (Fluid Compute) chosen by default** - no explicit `runtime` export needed
+- [ ] **Edge Runtime only chosen for an explicit, justified reason** - documented in a code comment at the top of the handler (e.g. genuine sub-Node-cold-start geo-routing need); never chosen by default or "for consistency" with older code
+- [ ] **If migrating a legacy Edge handler**, treated as a migration-audit task with its own verification pass, not copied as a template for new code
+
+## Caching Decision
+
+- [ ] **ISR/cache-header need identified** - does this route need periodic regeneration, or is a static response sufficient?
+- [ ] **If ISR is needed and a framework stack owns the route** - configured via that framework's own primitive, not hand-rolled `Cache-Control` headers in `vercel.json`
+- [ ] **If no framework owns the route** - any manual revalidation is implemented as plain HTTP caching via `vercel.json` `headers`, and documented as such (not called "ISR" — that term is reserved for the framework-level primitive)
+
+## Storage Decision
+
+- [ ] **Provider chosen deliberately**: Vercel Blob (native, for file/object storage) vs. a Marketplace integration (Neon for Postgres, Upstash for KV/Redis) - never `@vercel/kv` or `@vercel/postgres` (deprecated native packages)
+- [ ] **Connection/credentials sourced from the Marketplace integration's env vars**, not hardcoded or copied from a personal account
+
+## Cron Feature (if applicable)
+
+- [ ] **`crons` entry added to `vercel.json`** with a valid 5-field UTC schedule
+- [ ] **Plan's minimum interval and cron cap checked** before committing to a sub-hourly schedule
+- [ ] **Secret-guard implemented** in the handler (`Authorization: Bearer ${CRON_SECRET}`), see `templates/function-handler.template.ts`
+
+## Implementation
+
+- [ ] **Handler created** under `api/` (or the project's existing convention), one default export per file
+- [ ] **Env var validation guard added** at the top of the handler for any newly required variable
+- [ ] **`vercel.json` updated** with only the sections the new feature actually needs (`functions`, `crons`, `headers`) - no invented `regions`/`maxDuration`/`memory` values (YAGNI, rule 05)
+- [ ] **No secret hardcoded** - read from `process.env` only
+
+## Testing
+
+### Unit Tests
+
+- [ ] **Handler tested directly** by constructing a `Request` and asserting on the `Response` (or mocking the minimal `VercelRequest`/`VercelResponse` subset for legacy handlers)
+- [ ] **Method-not-allowed and malformed-input branches covered**
+- [ ] **Handler logic coverage >= 85%**
+
+### Cron Tests (if applicable)
+
+- [ ] **Secret-guard tested at 100%**: missing header, wrong secret, and correct secret — all three branches
+
+### Integration
+
+- [ ] **`vercel dev` smoke test** exercises the new route's `vercel.json` behavior (headers/rewrites/redirects), where applicable
+
+## Documentation
+
+- [ ] **`.env.example` updated** if a new env var was introduced
+- [ ] **`vercel.json` changes reviewed like code** - diffed and explained in the PR description, not silently regenerated
+
+## Final Checks
+
+- [ ] **Lint passes** - `npx eslint .`
+- [ ] **Types pass** - `tsc --noEmit`
+- [ ] **Tests pass** - `npx vitest run`
+- [ ] **`vercel.json` validated** - `npm run lint:vercel-config`
+- [ ] **`vercel build`** succeeds locally before pushing
+
+## Pull Request
+
+- [ ] **Descriptive title**
+- [ ] **Linked to issue/ticket**
+- [ ] **Any new deprecated-package or Edge Runtime usage explicitly justified** in the description
+- [ ] **Reviewers assigned**

package/Dev/i18n/base/Vercel/checklists/pre-commit.md

@@ -0,0 +1,59 @@
+# Vercel Pre-Commit Checklist
+
+> Covers the platform-specific surface only (`vercel.json`, `api/**`, `middleware.ts`). For the framework running on top of Vercel (Next.js, etc.), see that stack's own pre-commit checklist.
+
+## Quick Checks
+
+Run before every commit:
+
+```bash
+npx eslint . && tsc --noEmit && npx vitest run && npm run lint:vercel-config
+```
+
+## Checklist
+
+### `vercel.json`
+
+- [ ] **Validated against the platform schema** - `npx ajv validate -s schemas/vercel.schema.json -d vercel.json --strict=false`
+- [ ] **No key duplicated from a framework's own config** - check the decision tree in `02-architecture-vercel.md` before adding `headers`/`regions`/`functions`
+- [ ] **No invented `regions` or `functions.maxDuration`/`memory` value** - every non-default value has a concrete, documented reason (YAGNI, rule 05)
+- [ ] **Existing `vercel.json` never silently overwritten** - a regenerated file was diffed and confirmed against the previous version, not blindly replaced
+
+### Handler Code
+
+- [ ] **No secrets in handler code** - all secrets read from `process.env`, none hardcoded
+- [ ] **Env vars documented in `.env.example`** - every `process.env.X` referenced by a handler has a matching (empty/placeholder) entry
+- [ ] **Env var validation guard present** for any handler with a required var (see `templates/function-handler.template.ts`)
+- [ ] **No `console.log`** left in (warn/error only)
+
+### Cron Endpoints
+
+- [ ] **Secret-guard present** on every handler registered under `vercel.json`'s `crons` section - rejects requests missing or mismatching `Authorization: Bearer ${CRON_SECRET}`
+- [ ] **Guard is not the only line of defense** - path is not assumed to be secret/obscure
+
+### Deprecated Patterns
+
+- [ ] **No new `@vercel/kv` or `@vercel/postgres` import** - these native storage packages are deprecated; use Vercel Blob (native) or the Marketplace integrations (Neon for Postgres, Upstash for KV/Redis) instead
+- [ ] **No new `runtime: 'edge'` declaration** without an explicit migration comment - Edge Runtime is deprecated in favor of Fluid Compute; a legacy handler being touched must carry a comment explaining why it still targets Edge (see the migration note in `templates/function-handler.template.ts`)
+
+### Testing
+
+- [ ] **Tests pass** - `npx vitest run`
+- [ ] **New handler has tests**
+- [ ] **Coverage maintained** (>= 85% handler logic, 100% secret-guard branches)
+
+## Commands
+
+```bash
+# Full pre-commit check
+npx eslint . && tsc --noEmit && npx vitest run
+
+# Validate vercel.json against the platform schema
+npx ajv validate -s schemas/vercel.schema.json -d vercel.json --strict=false
+
+# Check for deprecated storage packages
+grep -rn "@vercel/kv\|@vercel/postgres" api/ package.json
+
+# Check for un-annotated Edge Runtime declarations
+grep -rn "runtime.*=.*['\"]edge['\"]" api/ middleware.ts 2>/dev/null
+```

package/Dev/i18n/base/Vercel/commands/check-architecture.md

@@ -0,0 +1,152 @@
+---
+description: Audit Vercel deployment configuration structure and project shape classification
+---
+
+# Vercel Architecture Audit
+
+You are an expert Vercel platform architect. Analyze the project's `vercel.json` and deployment configuration for correctness and maintainability, strictly within the deployment-platform scope of this stack.
+
+> Vercel is a **deployment platform**, not a framework. This command covers **only** `vercel.json`, Serverless Functions, ISR, Cron Jobs, Storage, and env/Preview Deployment config. For the framework's own routing/rendering/data-fetching conventions (e.g. Next.js App Router), use that framework's own `check-architecture` command instead.
+
+## MISSION
+
+Validate `vercel.json` schema correctness, classify the project's deployment shape, and flag configuration that duplicates or conflicts with a framework's native Vercel adapter.
+
+## Plan Mode
+
+> Plan mode is activated automatically when the scope spans multiple modules or requires cross-cutting investigation.
+
+## AUDIT AREAS
+
+### 1. Project Shape Detection
+
+```
+[ ] Identify shape: static+rewrites | Functions-backed | ISR-enabled | Cron+scheduled (or a combination)
+[ ] api/ directory present and mapped to Serverless Functions — Functions-backed shape
+[ ] revalidate / `Cache-Control: s-maxage` used on responses — ISR-enabled shape
+[ ] crons[] declared in vercel.json — Cron+scheduled shape
+[ ] Purely static output with rewrites/redirects only — static+rewrites shape
+```
+
+### 2. vercel.json Schema Validity
+
+```
+[ ] Valid JSON, conforms to the documented vercel.json schema (no unknown top-level keys)
+[ ] "$schema" reference present (editor validation) — optional but recommended
+[ ] No deprecated keys (e.g. legacy `routes` mixed with modern `rewrites`/`redirects`/`headers`)
+[ ] version field absent or set to 2 (legacy v1 config not used)
+```
+
+### 3. rewrites / redirects / headers Correctness
+
+```
+[ ] rewrites[] source patterns do not shadow static files unintentionally
+[ ] redirects[] use explicit `permanent: true|false` (never left implicit)
+[ ] headers[] scoped with precise `source` globs, not a blanket "/(.*)" for sensitive headers
+[ ] No conflicting rules where two rewrites/redirects match the same source with different destinations
+```
+
+### 4. regions / functions Configuration
+
+```
+[ ] functions{} block scopes memory/duration per-function-glob, not globally overbroad
+[ ] regions[] declared explicitly if data locality matters (default is auto/global)
+[ ] maxDuration set deliberately per function tier (not left at platform default for long-running jobs)
+[ ] Node.js runtime used by default; Edge Runtime only present with an explicit migration flag/comment
+```
+
+### 5. crons[] Configuration
+
+```
+[ ] Each cron entry has a valid path and schedule (standard cron syntax)
+[ ] Cron target endpoint exists under api/ and is not also publicly routable without auth (cross-check with check-security)
+[ ] No duplicate schedules pointing at the same path
+[ ] Cron frequency respects plan limits (documented, not assumed)
+```
+
+### 6. Framework Adapter Conflict Detection
+
+```
+[ ] No vercel.json rewrites duplicating a Next.js/Nuxt/SvelteKit adapter's own routing output
+[ ] No manual functions{} overrides fighting the framework's auto-detected build output
+[ ] next.config.js / nuxt.config.ts (or equivalent) is the source of truth for framework routing; vercel.json only for platform-level concerns
+```
+
+## OUTPUT FORMAT
+
+```
+══════════════════════════════════════════════════════════════
+VERCEL ARCHITECTURE AUDIT
+══════════════════════════════════════════════════════════════
+
+📊 ARCHITECTURE SCORE: XX/100
+
+🧭 PROJECT SHAPE
+──────────────────────────────────────────────────────────────
+Detected Shape: [static+rewrites | Functions-backed | ISR-enabled | Cron+scheduled | combination]
+Status: ✅ Consistent with conventions | ⚠️ Partial drift | ❌ Non-conforming
+
+Issues:
+- api/ directory present but no corresponding functions{} scoping in vercel.json
+  → Add explicit memory/duration bounds per function glob
+
+⚙️ VERCEL.JSON SCHEMA
+──────────────────────────────────────────────────────────────
+Status: ✅ Valid | ⚠️ Needs cleanup | ❌ Invalid
+
+Issues:
+- legacy `routes` array present alongside `rewrites`
+  → Migrate fully to `rewrites`/`redirects`/`headers`, remove `routes`
+
+🔀 REWRITES / REDIRECTS / HEADERS
+──────────────────────────────────────────────────────────────
+Rules found: X
+Conflicting rules: X
+
+Issues:
+- two redirects match "/blog/:slug" with different destinations
+  → Consolidate into a single unambiguous rule
+
+🌎 REGIONS / FUNCTIONS
+──────────────────────────────────────────────────────────────
+Status: ✅ Scoped deliberately | ⚠️ Overbroad | ❌ Missing
+
+Issues:
+- functions{} block sets maxDuration: 60 globally via "api/**"
+  → Scope duration per function tier; most handlers need far less
+
+⏰ CRON JOBS
+──────────────────────────────────────────────────────────────
+Crons declared: X
+Auth-guarded targets: X/X
+
+Issues:
+- crons[] target api/cleanup.ts also reachable as a public route
+  → See check-security for the CRITICAL auth-guard finding
+
+🧩 FRAMEWORK ADAPTER CONFLICTS
+──────────────────────────────────────────────────────────────
+Status: ✅ No conflicts | ⚠️ Overlap detected
+
+Issues:
+- vercel.json rewrites duplicate Next.js's own output routing
+  → Remove; let the framework's adapter own this concern
+
+📋 RECOMMENDATIONS
+──────────────────────────────────────────────────────────────
+Priority 1: [Resolve conflicting rewrite/redirect rules]
+Priority 2: [Scope functions{} bounds per handler]
+Priority 3: [Guard cron endpoints with a secret-header check]
+
+══════════════════════════════════════════════════════════════
+```
+
+## PROCESS
+
+1. Parse `vercel.json` and validate against the documented schema
+2. Detect project shape from directory layout (`api/`, cron declarations, revalidate usage)
+3. Validate rewrites/redirects/headers for conflicts and overbroad globs
+4. Review `regions`/`functions` scoping and runtime choice (Node.js default vs legacy Edge Runtime)
+5. Validate `crons[]` entries and cross-check target auth (flag for `check-security`)
+6. Detect configuration that duplicates or conflicts with a framework's native Vercel adapter
+7. Generate architecture report with a score out of 100

package/Dev/i18n/base/Vercel/commands/check-code-quality.md

@@ -0,0 +1,154 @@
+---
+description: Analyze Vercel Serverless Functions code quality with ESLint, TypeScript, and bundle-size checks
+---
+
+# Vercel Code Quality Audit
+
+You are an expert Vercel Functions code quality analyst. Perform comprehensive quality checks on `api/**` handlers and `middleware.ts`, strictly within the deployment-platform scope of this stack.
+
+> Vercel is a **deployment platform**, not a framework. This command covers **only** Serverless Function handlers and middleware code quality. For the framework's own component/route code quality (e.g. Next.js pages/components), use that framework's own `check-code-quality` command instead.
+
+## MISSION
+
+Analyze code quality across `api/` and `middleware.ts` with focus on ESLint rules, TypeScript strictness, handler signature conventions, and bundle-size awareness for Functions.
+
+## Plan Mode
+
+> Plan mode is activated automatically when the scope spans multiple modules or requires cross-cutting investigation.
+
+## QUALITY CHECKS
+
+### 1. ESLint Analysis
+
+```bash
+npx eslint api/ middleware.ts
+```
+
+Key rules to verify:
+- `@typescript-eslint/no-explicit-any`
+- `@typescript-eslint/no-unused-vars`
+- `no-console` (allow warn/error only — handler logs are visible in platform log drains)
+- `no-restricted-imports` (guards against importing deprecated `@vercel/kv`/`@vercel/postgres`)
+
+### 2. TypeScript Analysis
+
+```bash
+tsc --noEmit --strict
+```
+
+Verify:
+- No implicit `any` in handler signatures
+- `@vercel/node` types (`VercelRequest`, `VercelResponse`) or Web-standard `Request`/`Response` used consistently, not mixed
+- `strict: true` set in `tsconfig.json`
+
+### 3. Handler Signature Conventions
+
+Check every file under `api/`:
+```
+[ ] Request and response are explicitly typed (VercelRequest/VercelResponse or Request/Response)
+[ ] Required env vars validated at the TOP of the handler, before any business logic runs
+[ ] Handler returns early (guard clauses) on invalid method/missing env/invalid payload
+[ ] No env var read deep inside nested logic — read once at the top, pass down
+```
+
+### 4. Bundle-Size Awareness (Functions)
+
+```bash
+npx @vercel/ncc build api/heavy-handler.ts --out /tmp-bundle-check 2>&1 | tail -20
+```
+
+Flag:
+- Heavy dependencies imported at the top of a handler file when only used in one rare branch (prefer dynamic `import()` inside the branch)
+- Full SDK imports (`import * as aws from 'aws-sdk'`) instead of scoped submodule imports
+- Node built-ins bundled unnecessarily (check `externals` config for `@vercel/ncc`/build output)
+
+### 5. Middleware Quality
+
+Check `middleware.ts`:
+```
+[ ] matcher config scoped precisely (not a blanket "/(.*)" unless deliberate)
+[ ] No heavy synchronous work in middleware (runs on every matched request)
+[ ] No dynamic imports of Node-only packages incompatible with the middleware runtime
+```
+
+## OUTPUT FORMAT
+
+```
+══════════════════════════════════════════════════════════════
+VERCEL CODE QUALITY REPORT
+══════════════════════════════════════════════════════════════
+
+📊 QUALITY SCORE: XX/100
+
+🔍 ESLINT ANALYSIS
+──────────────────────────────────────────────────────────────
+Errors: X
+Warnings: X
+Files with issues: X
+
+Top Issues:
+1. @typescript-eslint/no-explicit-any (3 occurrences)
+   - api/webhook.ts:14
+
+2. no-restricted-imports (1 occurrence)
+   - api/cache.ts:2 — `import { kv } from '@vercel/kv'`
+     → Deprecated; migrate to Marketplace Upstash/Neon integration
+
+📝 TYPESCRIPT CHECK
+──────────────────────────────────────────────────────────────
+Status: ✅ PASS | ❌ FAIL
+Type Errors: X
+
+Issues:
+- api/webhook.ts:8
+  Parameter 'req' implicitly has an 'any' type
+
+🎯 HANDLER SIGNATURE CONVENTIONS
+──────────────────────────────────────────────────────────────
+Handlers reviewed: X
+Env validated at top: X/X
+Explicitly typed: X/X
+
+Issues:
+- api/orders.ts: process.env.DATABASE_URL read inside a nested try block on line 40
+  → Validate and read once at the top of the handler; fail fast if missing
+
+📦 BUNDLE-SIZE AWARENESS
+──────────────────────────────────────────────────────────────
+Handlers checked: X
+Heavy imports flagged: X
+
+Issues:
+- api/report.ts imports the full 'aws-sdk' package for one S3 call
+  → Use '@aws-sdk/client-s3' scoped submodule import instead
+
+⚙️ MIDDLEWARE QUALITY
+──────────────────────────────────────────────────────────────
+Status: ✅ Scoped | ⚠️ Overbroad matcher | ❌ Blocking work found
+
+Issues:
+- middleware.ts matcher is "/(.*)" — runs on every single request
+  → Scope matcher to the specific paths that need it
+
+📋 ACTION ITEMS
+──────────────────────────────────────────────────────────────
+1. [CRITICAL] Migrate off deprecated @vercel/kv / @vercel/postgres imports
+2. [HIGH] Fix TypeScript errors in handler signatures
+3. [MEDIUM] Validate env vars at handler top, not nested
+4. [LOW] Trim heavy imports flagged for bundle size
+
+══════════════════════════════════════════════════════════════
+```
+
+## COMMANDS TO RUN
+
+```bash
+# Full quality check
+npx eslint api/ middleware.ts && tsc --noEmit --strict
+
+# With auto-fix
+npx eslint api/ middleware.ts --fix
+
+# Deprecated storage package scan
+grep -rn "@vercel/kv\|@vercel/postgres" api/
+```

package/Dev/i18n/base/Vercel/commands/check-security.md

@@ -0,0 +1,197 @@
+---
+description: Security audit for Vercel deployment configuration (env vars, Cron auth, headers, Marketplace credentials)
+---
+
+# Vercel Security Audit
+
+You are an expert Vercel platform security auditor. Perform a comprehensive security analysis of the deployment configuration, strictly within the deployment-platform scope of this stack.
+
+> Vercel is a **deployment platform**, not a framework. This command covers **only** env var handling, Cron endpoint auth, `vercel.json` headers, Storage/Marketplace credentials, and Function runtime choice. For framework-level auth/session/input-validation concerns, use that framework's own `check-security` command instead.
+
+## MISSION
+
+Identify security vulnerabilities specific to Vercel's deployment model, mapped to the relevant OWASP Top 10:2025 categories (see `@.claude/rules/11-security.md`).
+
+## Plan Mode
+
+> Plan mode is activated automatically when the scope spans multiple modules or requires cross-cutting investigation.
+
+## SECURITY CHECKS
+
+### 1. Env Var Handling (OWASP #2 Cryptographic Failures, #5 Security Misconfiguration)
+
+Scan for:
+- Secrets logged via `console.log(process.env...)` in any `api/` handler
+- `.env.local` present in `.gitignore`
+- Preview vs Production env var scoping — production secrets not exposed to Preview Deployments unless deliberate
+- Client-bundled vars (`NEXT_PUBLIC_*` or equivalent) that actually hold a secret
+
+```bash
+grep -rn "console.log(process.env" api/
+grep -n "^\.env" .gitignore || echo "MISSING: .env.local not gitignored"
+```
+
+### 2. Cron Endpoint Auth (OWASP #1 Broken Access Control)
+
+Check every path referenced in `vercel.json` `crons[]`:
+- The endpoint validates a shared secret (e.g. `Authorization: Bearer $CRON_SECRET` or Vercel's `x-vercel-cron` signature) before executing
+- The endpoint is not otherwise reachable as a normal public route without that same guard
+- CRITICAL if a cron target performs a privileged/destructive action with **no** auth check at all
+
+```bash
+grep -A3 '"crons"' vercel.json
+grep -n "CRON_SECRET\|x-vercel-cron" api/**/*.ts
+```
+
+### 3. CORS / CSP Headers in vercel.json (OWASP #1, #5)
+
+Check `headers[]` in `vercel.json`:
+- `Access-Control-Allow-Origin` is not a bare `*` on any route handling authenticated requests
+- CSP (`Content-Security-Policy`) present and restrictive (`script-src`, `frame-ancestors`, `base-uri`)
+- `X-Content-Type-Options: nosniff`, `X-Frame-Options: DENY`, HSTS present
+
+### 4. Marketplace Credential Handling (OWASP #6 Supply Chain, #2 Cryptographic Failures)
+
+For Storage via Marketplace (Neon/Upstash, etc.):
+- Connection strings/API keys stored only as env vars, never committed
+- Marketplace integration scoped to least-privilege role (read-only where writes aren't needed)
+- Rotate-on-compromise process documented for Marketplace-issued credentials
+
+### 5. Deprecated Storage Package Migration Flags
+
+```bash
+grep -rn "@vercel/kv\|@vercel/postgres" package.json api/
+```
+Flag as a **migration item** (not a live vulnerability, but unsupported surface):
+- `@vercel/kv` → migrate to Upstash via Marketplace
+- `@vercel/postgres` → migrate to Neon (or another Marketplace Postgres) via Marketplace
+
+### 6. Legacy Edge Runtime Usage
+
+```bash
+grep -rn "runtime.*=.*['\"]edge['\"]\|export const runtime = 'edge'" api/ middleware.ts
+```
+Flag as a **migration item**: Edge Runtime is deprecated. Recommend migrating to the Node.js runtime default (Fluid Compute) — never recommend adopting Edge Runtime in new code.
+
+### 7. Dependency Security
+
+```bash
+npm audit --omit=dev --audit-level=moderate
+```
+
+## OUTPUT FORMAT
+
+```
+══════════════════════════════════════════════════════════════
+VERCEL SECURITY AUDIT
+══════════════════════════════════════════════════════════════
+
+📊 SECURITY SCORE: XX/100
+Risk Level: 🟢 LOW | 🟡 MEDIUM | 🔴 HIGH | ⚫ CRITICAL
+
+🔑 ENV VAR HANDLING (OWASP #2/#5)
+──────────────────────────────────────────────────────────────
+Status: ✅ SECURE | ⚠️ RISKS FOUND | ❌ VULNERABLE
+
+Findings:
+[🔴 HIGH] Secret value logged to stdout
+    File: api/webhook.ts:22
+    Code: console.log(process.env.STRIPE_SECRET_KEY)
+    Fix: Remove; never log secret env vars, even at debug level
+
+⏰ CRON ENDPOINT AUTH (OWASP #1)
+──────────────────────────────────────────────────────────────
+Status: ✅ GUARDED | ❌ UNGUARDED
+
+Findings:
+[⚫ CRITICAL] Cron target has no auth guard
+    File: api/cron/purge-db.ts
+    Fix: Validate `Authorization: Bearer ${CRON_SECRET}` (or Vercel's cron signature header) before executing; return 401 otherwise
+
+🌐 CORS / CSP HEADERS
+──────────────────────────────────────────────────────────────
+Status: ✅ CONSISTENT | ⚠️ PARTIAL | ❌ MISSING
+
+Findings:
+[🟡 MEDIUM] Access-Control-Allow-Origin: * on an authenticated API route
+    File: vercel.json
+    Fix: Restrict to explicit allowed origins
+
+🔐 MARKETPLACE CREDENTIALS (OWASP #6/#2)
+──────────────────────────────────────────────────────────────
+Status: ✅ LEAST PRIVILEGE | ⚠️ OVERSCOPED
+
+Findings:
+[🟡 MEDIUM] Neon connection string uses an admin-role credential for read-only queries
+    Fix: Issue a scoped read-only role via the Marketplace integration
+
+📦 DEPRECATED STORAGE PACKAGES (migration items)
+──────────────────────────────────────────────────────────────
+[ℹ️ MIGRATION] @vercel/kv imported in api/cache.ts
+    Fix: Migrate to Upstash via Vercel Marketplace
+
+⚙️ LEGACY EDGE RUNTIME (migration items)
+──────────────────────────────────────────────────────────────
+[ℹ️ MIGRATION] export const runtime = 'edge' in middleware.ts
+    Fix: Migrate to the Node.js runtime default (Fluid Compute); Edge Runtime is deprecated
+
+📦 DEPENDENCY AUDIT
+──────────────────────────────────────────────────────────────
+Total Dependencies: XX
+Vulnerabilities Found: X
+
+[🔴 HIGH] some-package < X.Y.Z
+    Fix: npm update some-package
+
+📋 ACTION ITEMS
+──────────────────────────────────────────────────────────────
+Priority 1 (CRITICAL):
+  - Add auth guard to every unguarded Cron endpoint
+
+Priority 2 (HIGH):
+  - Remove secret logging from handlers
+  - Update vulnerable dependencies
+
+Priority 3 (MEDIUM):
+  - Restrict CORS/CSP headers
+  - Scope Marketplace credentials to least privilege
+
+Priority 4 (MIGRATION, non-blocking):
+  - Migrate off @vercel/kv / @vercel/postgres to Marketplace equivalents
+  - Migrate off legacy Edge Runtime to Node.js/Fluid Compute
+
+══════════════════════════════════════════════════════════════
+```
+
+## COMMANDS
+
+```bash
+# Audit dependencies
+npm audit --omit=dev --audit-level=moderate
+
+# Check for secret logging
+grep -rn "console.log(process.env" api/
+
+# Check Cron auth guards
+grep -A3 '"crons"' vercel.json
+grep -n "CRON_SECRET\|x-vercel-cron" api/**/*.ts
+
+# Scan for deprecated storage packages and legacy Edge Runtime
+grep -rn "@vercel/kv\|@vercel/postgres" package.json api/
+grep -rn "runtime.*=.*['\"]edge['\"]" api/ middleware.ts
+```
+
+## SECURITY CHECKLIST
+
+```
+[ ] No secret env var ever logged (OWASP #2)
+[ ] .env.local gitignored, Preview/Production scoping deliberate (OWASP #5)
+[ ] Every crons[] target validates a shared secret before executing (OWASP #1)
+[ ] No cron target reachable unauthenticated as a public route (OWASP #1)
+[ ] CORS restricted to explicit origins on authenticated routes (OWASP #1)
+[ ] CSP/HSTS/nosniff/frame-ancestors present in vercel.json headers[] (OWASP #5)
+[ ] Marketplace credentials scoped to least privilege (OWASP #6)
+[ ] @vercel/kv / @vercel/postgres usage flagged for Marketplace migration
+[ ] No new code uses Edge Runtime; existing usage flagged for Fluid Compute migration
+[ ] Dependencies audited, no moderate+ vulnerabilities (OWASP #10)
+```