Findings
4 open findings
Recorded while walking, and deliberately not repaired — a walkthrough observes the product as the team committed it. Each one names where it was found so it can be reproduced.
Blocking
1Stops a feature being used, or exposes something that should be closed.The /admin gate is skipped entirely when ADMIN_PASSWORD is unset
admin-gate-fails-open/adminAdmin dashboardsrc/middleware.tswraps the admin cookie check inif (adminPassword). With the variable unset the branch is skipped and the request falls through toNextResponse.next(), so the dashboard, the studio and the new-presentation form all render to an anonymous visitor. Reproduced in a browser context with no cookies: /admin returned the dashboard rather than redirecting to /auth/admin.The risk is not the local machine — it is that a deploy which loses the variable exposes the admin area silently, with no error, no log line and nothing visibly different. A missing admin password should fail closed: deny and say why.
Major
1Works, but a user would notice and mind.Hydration mismatch on first render
console-gallery-1React reported that the server-rendered HTML did not match the client on first render, so the tree is thrown away and rebuilt in the browser. The user-visible cost is a flash of the wrong content and a slower first interaction; the maintenance cost is that any real SSR bug now hides inside a warning the team has learned to ignore.
Verified to be the app's own and not an artefact of how it was walked: the same error appears in a plain browser session with no clock pinning, no injected CSS and no emulation.
Full message:
Hydration failed because the server rendered HTML didn't match the client. As a result this tree will be regenerated on the client. This can happen if a SSR-ed Client Component used:
- A server/client branch
if (typeof window !== 'undefined'). - Variable input such as
Date.now()orMath.random()which changes each time it's called. - Date formatting in a user's locale which doesn't match the server.
- External changing data without sending a snapshot of it along with the HTML.
- Invalid HTML tag nesting.
It can also happen if the client has a browser extension installed which messes wi
- A server/client branch
Minor
2Small and real.Error: <svg> attribute height: Expected length, "auto".
console-deck-scroll-2/awwwards-flagshipScroll deckError: <svg> attribute height: Expected length, "auto".
The gallery's grouping control is a native <select>
native-select-on-galleryThe grouping control renders a bare
<select>with the options No grouping / By type / By customer / By author / By date. Native selects draw their popup with OS chrome, which ignores the app's dark theme and differs between macOS, Windows and Android — so the one control on the page that opens a menu is the one control that will not match the design. The workspace's own UI standard calls for the project's Select component here.