P2: CSP allows unsafe-inline for styles — weakens XSS protection
P2: RATE_LIMIT_PER_MINUTE env var NaN on invalid input — rate limiting silently disabled
P1: Header CTA button uses plain Link instead of Button component
P1: No unique constraint on email field — duplicate leads possible
P1: Header SheetTrigger imported without Sheet wrapper — mobile nav may be broken
P1: Zoho URL double-slash if ZOHO_API_DOMAIN has trailing slash
P1: Frontend api.js does not handle CORS errors — generic error message shown
P0: Zoho token fetch does not check response.ok before parsing JSON
P0: su-exec in Docker entrypoint may fail silently — container runs as root
P1: No timeout on Zoho token fetch — server hangs if Zoho is down
P0: Zoho token failure returns null but forwardToZoho continues
c2d5873f08
feat: error handling hardening, 404 catch-all, health check DB test, request timeout, global error handlers (v0.4.8)
7257633d94
feat: rate limiting, helmet security headers, CORS, trust proxy, Docker env vars (v0.4.7)
39ee1fe537
feat: structured logging with timestamps, request logging, and submission details (v0.4.6)