P1: Zoho URL double-slash if ZOHO_API_DOMAIN has trailing slash
P1: Header CTA button uses plain Link instead of Button component
P0: Zoho token failure returns null but forwardToZoho continues
P0: Zoho token fetch does not check response.ok before parsing JSON
P1: No timeout on Zoho token fetch — server hangs if Zoho is down
P1: Header SheetTrigger imported without Sheet wrapper — mobile nav may be broken
P0: su-exec in Docker entrypoint may fail silently — container runs as root
Final remediation (7c145bc):
- Removed
chmod 777on /app/db and /app/logs → now useschown -R nodejs:nodejs - Removed hardcoded
su-execcall → entrypoint now detects root vs…
Batch 0.5.3: Trust signals section — B2B credibility
P0: su-exec in Docker entrypoint may fail silently — container runs as root
Hudson security review (post-fix):
- Dockerfile correctly uses USER nodejs — no su-exec needed
- Entry point cleaned up: removed chmod 777 (→ chown), removed hardcoded su-exec, added…
Batch 0.5.3: Trust signals section — B2B credibility
Batch 0.5.2: Hero section rewrite — B2B value proposition
Batch 0.5.2: Hero section rewrite — B2B value proposition