user

type: text

text:
date: 2026-07-26
scan_dates:
[
  "2026-07-25",
  "2026-07-26"
]
hint: (none)
max_units: 5

changed_paths:
[
  "memory/2026-07-26.md",
  "memory/2026-07-26/sumopod-security-audit-findings.md",
  "memory/2026-07-26/svaha-fb-ads-creative-production.md"
]

# Changed material

### memory/2026-07-26.md
---
description: 2 note(s) today.
name: '2026-07-26'
---

<!-- notes:auto -->
- [[memory/2026-07-26/sumopod-security-audit-findings.md]] name: sumopod-security-audit-findings description: Comprehensive security audit of sumopod.com revealing critical vulnerabilities: exposed Supabase anon key (expires 2062) hardcoded in JavaScript bundle, verbose error messages hinting at service_role key requirements, publicly accessible sandbox payment API (api-pay-sandbox.sumopod.com), missing rate limiting, leaked API endpoints in bundle, and CORS misconfiguration. Testing methodology included endpoint fuzzing, JavaScript bundle analysis, Supabase RLS verification, and API endpoint mapping. Positive findings include active RLS protection, Cloudflare WAF blocking path traversal, proper CSP headers, and HSTS enforcement. Complete 25-page PDF security audit report generated with 9 total findings (2 critical, 1 high, 4 medium, 2 low severity) including prioritized recommendations for immediate action (rotate Supabase keys, fix error messages, IP whitelist sandbox API) and urgent fixes (implement rate limiting, audit RLS policies, configure CORS). Report files delivered: SumoPod_Security_Audit_Report_2026-07-26.pdf (16KB) and SumoPod_Security_Audit_Report.md (11KB). Email delivery to websiteidola@gmail.com attempted but blocked by network restrictions (transfer.sh and file.io unavailable); files sent via direct file transfer interface instead.
- [[memory/2026-07-26/svaha-fb-ads-creative-production.md]] name: svaha-fb-ads-creative-production description: Svaha Tour & Travel FB Ads creative production log. 11 ads storyboard+copy ready; infrastructure not yet built. Mas Eko focused on ad creative first using AI generation. Video 1 'Skip the Tourist Traps' (TOF, 15s) fully produced as 2 Veo Omni scenes (8s each, 9:16), using Kukuhaldy Nano Structure anti-AI prompts — complete JSON per scene with text_overlay_capcut timestamps documented. Video 2 'What's Included vs NOT' (MOF, Carousel 5 slide) storyboard ready, not yet executed. Full ad priority list (11 ads, 3 tiers), Meta Ads campaign targeting (Australia, AUD $5-7/day), and QwenPaw 2.0.1 update also recorded.
<!-- /notes:auto -->

### memory/2026-07-26/sumopod-security-audit-findings.md
---
description: 'Comprehensive security audit of sumopod.com revealing critical vulnerabilities:
  exposed Supabase anon key (expires 2062) hardcoded in JavaScript bundle, verbose
  error messages hinting at service_role key requirements, publicly accessible sandbox
  payment API (api-pay-sandbox.sumopod.com), missing rate limiting, leaked API endpoints
  in bundle, and CORS misconfiguration. Testing methodology included endpoint fuzzing,
  JavaScript bundle analysis, Supabase RLS verification, and API endpoint mapping.
  Positive findings include active RLS protection, Cloudflare WAF blocking path traversal,
  proper CSP headers, and HSTS enforcement. Complete 25-page PDF security audit report
  generated with 9 total findings (2 critical, 1 high, 4 medium, 2 low severity) including
  prioritized recommendations for immediate action (rotate Supabase keys, fix error
  messages, IP whitelist sandbox API) and urgent fixes (implement rate limiting, audit
  RLS policies, configure CORS). Report files delivered: SumoPod_Security_Audit_Report_2026-07-26.pdf
  (16KB) and SumoPod_Security_Audit_Report.md (11KB). Email delivery to websiteidola@gmail.com
  attempted but blocked by network restrictions (transfer.sh and file.io unavailable);
  files sent via direct file transfer interface instead.'
name: sumopod-security-audit-findings
session_id: 4bbfb791c7e64882939e7dfd899d38f2
source_conversation: '[[mem_session/dialog/4bbfb791c7e64882939e7dfd899d38f2.jsonl]]'
---

# SumoPod Security Audit - Complete Findings

**Auditor:** Eko Budi
**Target:** sumopod.com (SPA with client-side routing)
**Date:** 2026-07-26
**Report File:** `SumoPod_Security_Audit_Report_2026-07-26.pdf` (25+ pages)

---

## 🔴 CRITICAL FINDINGS (2)

### 1. Supabase Anon Key Exposed in JavaScript Bundle
**Severity:** CRITICAL (CVSS 9.1)

**Exposed Key:**
```
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6ImRoc3J3YnVmcGR2dXB0ZHplaWVvIiwicm9sZSI6ImFub24iLCJpYXQiOjE3NDY0NTQ4NTUsImV4cCI6MjA2MjAzMDg1NX0.7dhHHFZZArMOQgFwehICyjY-QKehZ9gvrVt8hOXTJX0
```

**Details:**
- Project: `dhsrwbufpdvuptdzeieo.supabase.co`
- Expires: 2062 (36 years from creation)
- Hardcoded in `/assets/index-C1Pn7-qa.js` (877KB bundle)
- **GOOD NEWS:** RLS (Row Level Security) is ACTIVE - tested queries to `profiles`, `payments`, `merchants`, `users` tables all return empty arrays or "table not found"
- **BAD NEWS:** Still exploitable for brute force, DOS, and future RLS misconfigurations

### 2. Verbose Error Messages
**Severity:** HIGH

**Example:**
```json
{"message":"Invalid API key","hint":"Only the `service_role` API key can be used for this endpoint."}
```

**Risk:** Error message provides roadmap to attackers by hinting that service_role key exists and where it's needed.

---

## 🟠 HIGH SEVERITY (1)

### 3. Sandbox Payment API Publicly Accessible
**Target:** `api-pay-sandbox.sumopod.com`
**Issue:** Reachable from public internet with no IP whitelist or VPN requirement

**Gateway:** Kong API Gateway (identified via headers)
**Status:** All tested endpoints return "no Route matched" but gateway is live

**Should only be accessible from:**
- Office IP addresses
- Development machines
- CI/CD pipeline

---

## 🟡 MEDIUM SEVERITY (4)

### 4. No Rate Limiting Detected
- Tested 5+ rapid requests to multiple endpoints
- Response time stable ~0.15s
- No throttling or rate limit headers observed
- Risk: Brute force attacks, DOS vulnerability if valid endpoints discovered

### 5. API Endpoints Leaked in JavaScript Bundle

**Payment API Endpoints Found:**
```
Base: api-pay-sandbox.sumopod.com
/v1/payments
/v1/merchant/access
/v1/merchant/payments/
/v1/merchant/withdrawals
/v1/merchant/withdrawals/info
```

**Webhook Endpoints Found:**
```
gate.sumopod.com/webhook/sumopod/affiliate/summary
gate.sumopod.com/webhook/sumopod/affiliate/transactions
gate.sumopod.com/webhook/sumopod/affiliate/verify
```

**Risk:** Complete API structure map available to attackers; webhook endpoints may lack signature verification.

### 6. Missing CORS Headers
- Tested with `Origin: https://evil.com` header
- No `Access-Control-Allow-Origin` response headers
- Could be intentional whitelist OR configuration bug
- May cause frontend issues or XSS risks

### 7. Cache Control Misconfiguration
- Frontend serves with `Cache-Control: max-age=0, must-revalidate`
- No caching for static assets
- Performance impact on repeated visits

---

## ⚪ LOW SEVERITY (2)

### 8. Kong Gateway Info Disclosure
- `x-kong-*` headers visible in responses
- Reveals tech stack to potential attackers
- Minimal risk but unnecessary information leakage

### 9. Webhook Endpoint Connection Issues
- `gate.sumopod.com/webhook/sumopod/affiliate/verify` returns connection error (exit code 6)
- Could indicate: endpoint doesn't exist, server down, or rate limiting

---

## ✅ POSITIVE SECURITY CONTROLS

**What's Working Well:**

1. **RLS Active on Supabase** - Data protected despite anon key exposure
2. **Cloudflare WAF Active** - Path traversal attempts blocked (tested with `%2e%2e/%2e%2e/etc/passwd`)
3. **HTTPS + HSTS Enforced** - All traffic encrypted
4. **CSP Headers Properly Configured** - Strict Content Security Policy in place
5. **Bot Protection Active** - Cloudflare Turnstile enabled
6. **Generic Kong Errors** - Most endpoints return generic "no Route matched" (good for security)
7. **X-Frame-Options Set** - Clickjacking protection
8. **SPA Client-Side Routing** - Server doesn't expose route structure

---

## 🎯 PRIORITIZED RECOMMENDATIONS

### IMMEDIATE (Within 24 Hours)

1. **Rotate Supabase Anon Key**
   - Generate new key with shorter expiration (1 year max, not 36)
   - Use environment-based keys (dev vs prod)
   - Update all client applications

2. **Fix Error Messages**
   - Remove hints about `service_role` key
   - Return generic `401 Unauthorized` or `403 Forbidden`

3. **IP Whitelist Sandbox Payment API**
   - Restrict `api-pay-sandbox.sumopod.com` to internal IPs only
   - Consider VPN or private network requirement

### URGENT (Within 1 Week)

4. **Implement Rate Limiting**
   - Kong gateway supports built-in rate limiting
   - Recommend: 100 req/min for anon, 1000 req/min for authenticated

5. **Audit All RLS Policies**
   - Verify every Supabase table has proper RLS
   - Test with exposed anon key to ensure no data leaks
   - Check tables: `ai_users`, `payments` (hinted in error messages)

6. **Configure CORS Properly**
   - Explicit whitelist of allowed origins
   - Document intended CORS policy

### SHORT-TERM (1 Month)

7. **Obfuscate API Endpoints in Bundle**
   - Use environment variables or runtime config
   - Avoid hardcoding full paths in JavaScript

8. **Add Webhook Signature Verification**
   - Implement HMAC signatures for all webhook endpoints
   - Verify signatures before processing requests

9. **Optimize Cache Headers**
   - Enable caching for static assets
   - Use appropriate TTL for JavaScript bundles

10. **Remove Unnecessary Headers**
    - Strip `x-kong-*` headers in production
    - Minimize tech stack disclosure

---

## 📊 TESTING METHODOLOGY

**Tools Used:**
- `curl` for HTTP request testing
- Browser DevTools for JavaScript analysis
- `jq` for JSON parsing
- Supabase REST API client

**Approach:**
1. **Basic Infrastructure Testing** - Response codes, headers, security headers
2. **Endpoint Fuzzing** - Common paths, admin panels, debug endpoints
3. **JavaScript Bundle Analysis** - Extract 877KB bundle, search for secrets/endpoints
4. **API Endpoint Testing** - Hit discovered endpoints with various methods
5. **Supabase RLS Verification** - Query with exposed anon key
6. **Attack Vector Testing** - Path traversal, header injection, CORS bypass

**Endpoints Tested:**
- Frontend: `sumopod.com` (all routes return 200, SPA)
- AI Backend: `ai.sumopod.com` (404)
- WebSocket: `ws.sumopod.com` (404)
- Payment Sandbox: `api-pay-sandbox.sumopod.com` (Kong gateway, all routes 404)
- Payment Production: `api-gate-v2.sumopod.com` (404)
- Supabase: `dhsrwbufpdvuptdzeieo.supabase.co` (RLS active)

---

## 📋 SUMMARY TABLE

| Finding | Severity | Status | Immediate Risk |
|---------|----------|--------|----------------|
| Supabase anon key exposed | 🔴 CRITICAL | Unresolved | Medium (RLS mitigates) |
| Verbose error messages | 🔴 CRITICAL | Unresolved | Low |
| Sandbox API public | 🟠 HIGH | Unresolved | Medium |
| No rate limiting | 🟡 MEDIUM | Unresolved | Medium |
| Leaked API endpoints | 🟡 MEDIUM | Unresolved | Low |
| Missing CORS | 🟡 MEDIUM | Unresolved | Low |
| Cache misconfiguration | 🟡 MEDIUM | Unresolved | Low |
| Kong info disclosure | ⚪ LOW | Unresolved | Very Low |
| Webhook endpoint issues | ⚪ LOW | Unresolved | Very Low |

**Total Issues:** 9
**Requires Immediate Action:** 3
**Overall Risk Level:** HIGH (mitigated by strong RLS policies)

---

## 📝 NOTABLE DISCOVERIES

**Database Tables Discovered (via error hints):**
- `public.ai_users`
- `public.payments`
- `public.profiles`

**Tech Stack Confirmed:**
- Frontend: React SPA (Vite build)
- Backend: Kong API Gateway
- Database: Supabase (PostgreSQL)
- CDN/Security: Cloudflare
- Payment Processing: Custom API (sandbox + production)
- WebSocket: Separate ws.sumopod.com endpoint

**Security Headers Present:**
- `Content-Security-Policy` (strict)
- `Strict-Transport-Security`
- `X-Frame-Options: DENY`
- `X-Content-Type-Options: nosniff`

---

## ⚠ DISCLAIMER

This security audit was conducted at the request of the system owner. Testing was performed from external perspective only, without authenticated access or internal documentation. Some findings may require internal system knowledge to fully assess. The absence of a finding does not guarantee security - further testing with authenticated access and internal knowledge may reveal additional issues.

---

## 📄 DELIVERABLES

### Report Files Generated

1. **PDF Report:** `SumoPod_Security_Audit_Report_2026-07-26.pdf`
   - Size: 16KB
   - Pages: 25+
   - Sections: Executive Summary, Critical Findings, High/Medium/Low Severity Issues, Positive Controls, Recommendations, Testing Methodology, Disclaimer

2. **Markdown Report:** `SumoPod_Security_Audit_Report.md`
   - Size: 11KB
   - Full content identical to PDF
   - Suitable for version control, web rendering (GitHub/GitLab), or conversion to other formats

### Distribution Attempts

**Email delivery attempted to:** `websiteidola@gmail.com`

**Challenges encountered:**
- Himalaya CLI not installed on system
- Email setup would require Gmail App Password (16-digit) for SMTP configuration
- Network restrictions blocking external file sharing services (transfer.sh returned connection refused, file.io returned 301 redirect)

**Resolution:**
- Both PDF and Markdown files sent via `send_file_to_user` interface
- Files located at: `/app/working/workspaces/default/`
- User opted to receive files directly rather than continue email setup

**Alternative distribution methods discussed:**
- Manual copy-paste of Markdown content
- Online Markdown-to-PDF converters (markdown-to-pdf.com, dillinger.io)
- Gmail App Password setup for Himalaya CLI (not pursued)

### memory/2026-07-26/svaha-fb-ads-creative-production.md
---
description: Svaha Tour & Travel FB Ads creative production log. 11 ads storyboard+copy
  ready; infrastructure not yet built. Mas Eko focused on ad creative first using
  AI generation. Video 1 'Skip the Tourist Traps' (TOF, 15s) fully produced as 2 Veo
  Omni scenes (8s each, 9:16), using Kukuhaldy Nano Structure anti-AI prompts — complete
  JSON per scene with text_overlay_capcut timestamps documented. Video 2 'What's Included
  vs NOT' (MOF, Carousel 5 slide) storyboard ready, not yet executed. Full ad priority
  list (11 ads, 3 tiers), Meta Ads campaign targeting (Australia, AUD $5-7/day), and
  QwenPaw 2.0.1 update also recorded.
name: svaha-fb-ads-creative-production
session_id: 192278ce492a4c9abcc46767a615d64b
source_conversation: '[[mem_session/dialog/192278ce492a4c9abcc46767a615d64b.jsonl]]'
---

# Svaha Tour & Travel — FB Ads Creative Production

## Project Status (as of 2026-07-26)

### Assets DONE (Ready to Use)
- 11 ads storyboard + copy (TOF 4, MOF 4, BOF 3)
- Landing page copy Second Home Visa (9 sections, full)
- Nano prompts AI Product Photo (4 use cases)
- Funnel agreed: Meta Ads → Landing Page → WhatsApp
- WA template auto-reply after form submit
- Setup guides for Pixel, Fluent Forms, reCAPTCHA

### NOT Yet Executed (Blocking Launch)
- Meta Pixel not installed on website
- Landing page Second Home not built on WP
- Fluent Forms + WA redirect not set up
- reCAPTCHA not added
- Video ads not produced (170+ footage files exist but unedited)
- WA Business not connected to FB Page
- Testimonial AU/NL specific not collected

### User Decision
- Mas Eko chose to **focus on ad creative only first**, not infrastructure
- Wants to produce ads using **AI generation** (not manual editing from footage)
- Starting with **Video 1: "Skip the Tourist Traps"** (TOF, Priority 1)

---

## Video 1 — "Skip the Tourist Traps" (15s, 4 scenes)

### Scene 1 — HOOK (0:00–0:03)
- POV walking through Tegalalang rice terraces, morning mist, handheld feel
- Text overlay: `Skip the tourist traps` (Montserrat ExtraBold, white + black shadow, fade in 0.3s)

### Scene 2 — TRUST (0:03–0:07)
- Local guide smiling warmly, chatting with Australian tourist, close-up candid
- Text overlay: `Meet a real local guide` / `(not a random driver)`

### Scene 3 — EXPERIENCE (0:07–0:11)
- Fast cuts (1-1.5s each): Melukat ritual → Balinese dance/culture → Warung makan
- Text overlay rotating: `Sacred temple moments` → `Real culture` → `Your pace`
- Text color: white or soft yellow (#FFD700) + black outline

### Scene 4 — OUTRO CTA (0:11–0:15)
- Drone/wide shot rural Bali road, private car on green road
- Text overlay: `Private Ubud day` / `Local guide. No tourist traps.` / `Message us for your itinerary`

### Audio
- Music: Tropical house chill / island acoustic, 60-70% volume
- SFX: Bird chirp (1s), water splash (8s)

### Caption
```
Skip the tourist traps.
See the real Bali with a local friend.

Private tours with an English-speaking guide who actually knows the island —
not a random driver who rushes you through souvenir shops.

Tell us your dates. We'll send a custom plan.
```
- Headline: `Real Bali. Local guide. No traps.`
- CTA: Send Message / WhatsApp

---

## AI Generation Prompts (Per Scene)

| Scene | Prompt |
|-------|--------|
| 1 | POV walking through lush green rice terraces, morning mist, Tegalalang Bali, handheld camera feel, cinematic |
| 2 | Indonesian local guide smiling warmly, chatting with Australian tourist, close-up, natural candid, Bali outdoor |
| 3a | Balinese Melukat purification ritual at temple water spring, sacred, cinematic |
| 3b | Balinese traditional dance at village temple, authentic cultural moment |
| 3c | Tourist eating at local warung, relaxed, real, candid |
| 4 | Wide drone shot of rural Bali road, green hills, peaceful, private car driving |

### Production Options
- **Opsi A**: AI Image → animate each scene → combine + text overlay (most controllable)
- **Opsi B**: AI Video direct (Kling/Runway/Pika) per scene (less consistent between scenes)
- **Opsi C**: Mix AI + real footage from 170+ files

### Pending Question
- Mas Eko hasn specified which AI tool they have access to (Midjourney, DALL-E, Kling, Runway, etc.)

---

## Veo Omni Production — Video 1 (2 Scenes, Anti-AI Look)

Mas Eko confirmed using **Veo Omni** for video generation. Video 1 bedah jadi 2 scene @ 8 detik, 9:16.
Prompts pakai **Kukuhaldy Nano Structure + Realism Constraints** dari memory AI fotografi — agar tidak kelihatan AI.

### Realism Booster (append ke semua prompt)
```
Photorealistic, documentary travel photography, natural skin texture with visible pores, slight imperfections, real candid moment, not studio perfect, no plastic skin, no beauty filter, no CGI look, no oversharpening, natural color grading, subtle film grain, authentic Bali atmosphere, shot on Sony A7IV documentary style.
```

### Anti-AI Constraints (CRITICAL — selalu sertakan)
```
CRITICAL: Keep all faces natural and unretouched. No perfect symmetry. No porcelain skin. No fake smile. No warped hands. No extra fingers. No distorted eyes. No invented logos or unreadable text. No watermark. No stock-photo feel. No cinematic fake HDR. Must look like real footage taken by a traveler or local photographer in Bali.
```

### Scene 1 — HOOK + TRUST (0:00–0:07, 8 detik)

```json
{
  "scene": 1,
  "label": "HOOK + TRUST",
  "duration": "8 seconds",
  "aspect_ratio": "9:16",
  "prompt": "A traveler's handheld POV walking along a narrow dirt path through lush layered Tegallalang rice terraces in Bali, early morning soft mist hovering over the paddies, slightly unsteady camera movement like a real person walking, palm trees on the sides, humid tropical air feel. Then cuts to a candid close-up of a Balinese local male guide in his 30s in a simple clean collared shirt, naturally mid-conversation with a Western traveler, smiling genuinely — not posed, not looking at camera. Real laugh lines, natural skin pores, slight sweat sheen, casual relaxed body language. Shot on Sony A7IV documentary style, 35mm, shallow depth of field, warm natural morning light, no harsh flash, subtle film grain, authentic Bali travel atmosphere. CRITICAL: no plastic skin, no porcelain faces, no perfect symmetry, no fake smile, no beauty filter, no watermark, no CGI look, no stock-photo feel. Must look like a real traveler filmed this on their camera.",
  "text_overlay_capcut": [
    { "detik": 0, "teks": "Skip the tourist traps" },
    { "detik": 4, "teks": "Meet a real local guide" }
  ]
}
```

### Scene 2 — EXPERIENCE + CTA (0:07–0:15, 8 detik)

```json
{
  "scene": 2,
  "label": "EXPERIENCE + CTA",
  "duration": "8 seconds",
  "aspect_ratio": "9:16",
  "prompt": "Quick authentic travel montage in Bali: first a traveler with wet hair participating in a Melukat holy water purification ritual at a mossy stone temple spring, water flowing naturally, sarong fabric wet and heavy, sincere focused expression not exaggerated, incense smoke faintly visible. Then a candid moment of a local guide and an Australian traveler laughing together sharing coconut water at a rustic warung overlooking rice fields, imperfect real teeth smile, not looking at camera. Ends with a wide steady drone-style shot of a clean white private MPV car driving slowly along a quiet green Ubud village road, no tourist buses, morning light, tropical trees. Documentary travel style, warm natural color grade, subtle film grain, real clothing wrinkles, natural motion. Shot on Sony A7IV. CRITICAL: no plastic beauty, no model-perfect faces, no deformed hands, no extra fingers, no distorted anatomy, no invented logos on car, no text in frame, no watermark, no CGI oversharpening. Must feel like real guest footage, not a commercial.",
  "text_overlay_capcut": [
    { "detik": 0, "teks": "Sacred moments" },
    { "detik": 2, "teks": "Real culture. Your pace." },
    { "detik": 5, "teks": "Private Ubud day" },
    { "detik": 7, "teks": "Message us for your itinerary ↓" }
  ]
}
```

### Checklist Sebelum Pakai (Video 1)
- [ ] Kulit ada tekstur/pori, tidak porselen
- [ ] Senyum natural, bukan iklan pasta gigi
- [ ] Tangan & jari normal
- [ ] Background Bali terasa nyata, tidak unreal HDR
- [ ] Tidak ada tulisan aneh hasil AI
- [ ] Terasa candid, bukan stock footage

> Jika 2+ item gagal → regenerate. Teks overlay pasang di CapCut setelah video jadi, jangan minta Veo generate teks.

---

## Video 2 — "What's Included vs NOT" (Carousel 5 Slide, MOF)

**Tipe:** Carousel 5 slide | **Funnel:** MOF (Consideration)
**Tujuan:** Orang yang sudah tahu Svaha tapi masih ragu — buat mereka yakin dengan transparansi.

| Slide | Visual | Teks |
|---|---|---|
| 1 (Cover) | Foto guide + guest jalan | `What's included — and what's NOT` |
| 2 | Foto mobil private | ✅ Private car & driver / ✅ English-speaking guide / ✅ Hotel pickup & drop |
| 3 | Foto makan lokal / tiket pura | ✅ Local lunch / ✅ Temple entrance fees / ✅ Bottled water |
| 4 | Foto toko suvenir (dicoret/X) | ❌ No shopping stops / ❌ No hidden fees / ❌ No rushing |
| 5 (CTA) | Foto Bali tenang/sawah | `Your day. Your pace.` / `Message us your dates ↓` |

**Status:** Storyboard ready, belum diproduksi. Mas Eko bertanya soal ini tapi belum mulai eksekusi.
Pertanyaan terbuka: apakah akan dieksekusi pakai Veo Omni (2 scene per slide) atau Canva/AI image?

---

## Full Ad Priority List

### Priority 1 — Launch First (3 ads)
1. **Skip the Tourist Traps** (Ubud) — Video 15s ← CURRENT FOCUS
2. **What's Included vs NOT** — Carousel 5 slide
3. **Coming to Bali Soon?** — Static

### Priority 2 — Following Week (3 ads)
4. Adventure Without the Chaos — Video 15s
5. No Tourist Traps Promise — Static
6. 10-Minute Custom Plan — Static

### Priority 3 — Complementary (5 ads)
7. Like Traveling with a Friend — Video 15s
8. What Australians Hate — Video 15s
9. 3 Signs Good Guide — Carousel 5 slide
10. Real Photos Only — Static
11. Social Proof — Static (needs testimonial)

---

## Meta Ads Campaign Setup (after creative ready)
- 3 Campaigns: TOF→Messages, MOF→Messages, BOF→Messages
- Targeting: Australia (Sydney, Melbourne, Brisbane, Perth, Adelaide, Gold Coast), Age 25-55
- Interests: Bali, Ubud, Seminyak, Travel, Holiday planning
- Behavior: Frequent international travelers
- Budget: AUD $5-7/day per ad set, test 3-5 days
- CTA: Send Message / WhatsApp

---

# QwenPaw 2.0.1 Update (Brief)

Released July 24, 2026. Key updates:
1. PawApp SDK & Kanban App — mini-app platform with UI inside QwenPaw, built-in Kanban
2. User-editable Agent Mode — create/edit agent modes from console (iterations, stop conditions, approval)
3. Oh-My-Paw Plugin — 5 agent loop modes: UltraQA, Ralph, Ultrawork, Autopilot, Team
4. Langfuse Trace Enrichment — richer logs (user ID, session ID, package version)
5. History Retention Config — set chat history retention days from console
6. Drag-and-Drop File Upload — in desktop app
7. Agent Reasoning Optimization — no repeated thinking/tool calls, faster & more efficient

Extract merged memory units and daily interest topic candidates.

role: user


default

text:
```yaml
units:
  - name: supabase-spa-exposure-pattern
    bucket: wiki
    summary: >
      When a React/Vite SPA is built, secrets and internal API structure baked
      into the JavaScript bundle become trivially extractable — even from a
      minified 877KB file. The SumoPod audit demonstrates the full attack
      surface this creates: the Supabase anon key (hardcoded, 36-year expiry),
      full internal API endpoint tree (Kong gateway routes, webhook paths), and
      tech stack fingerprinting all recovered from bundle analysis alone. The
      key mitigation pattern is runtime config injection (env vars resolved at
      deploy time, not build time) combined with short-lived keys and RLS as
      the last line of defense. RLS being active meaningfully reduced the
      immediate blast radius here despite the key exposure — a useful
      precedent for defense-in-depth reasoning.
    paths:
      - memory/2026-07-26/sumopod-security-audit-findings.md
      - memory/2026-07-26.md

  - name: web-security-audit-methodology
    bucket: procedure
    summary: >
      The SumoPod engagement establishes a repeatable external black-box audit
      workflow for SPAs: (1) baseline infrastructure scan — response codes,
      security headers, HSTS, CSP, X-Frame-Options; (2) endpoint fuzzing —
      common admin/debug paths; (3) JavaScript bundle extraction and secret/
      endpoint grep; (4) API endpoint probing with discovered routes; (5)
      database RLS verification using any exposed keys; (6) active attack
      vector testing — path traversal, CORS bypass, header injection. Tooling
      used: curl, browser DevTools, jq. Output: severity-bucketed findings
      (CVSS where applicable) with a three-horizon remediation roadmap
      (immediate ≤24h, urgent ≤1 week, short-term ≤1 month). Report delivered
      as both PDF and Markdown for flexibility.
    paths:
      - memory/2026-07-26/sumopod-security-audit-findings.md

  - name: kukuhaldy-nano-structure-anti-ai-prompts
    bucket: procedure
    summary: >
      For AI video generation (Veo Omni confirmed), the Kukuhaldy Nano
      Structure uses two mandatory append blocks to suppress the AI aesthetic:
      a Realism Booster (documentary style, natural skin texture, film grain,
      Sony A7IV framing language) and an Anti-AI Constraints block (no perfect
      symmetry, no porcelain skin, no warped hands, no invented text, no
      stock-photo feel). The pattern is validated against a concrete
      pass/fail checklist (≥2 failures → regenerate). Text overlays are
      explicitly deferred to CapCut post-production rather than generated
      in-prompt. This technique is reusable across any AI video/image tool
      where photorealism matters.
    paths:
      - memory/2026-07-26/svaha-fb-ads-creative-production.md

  - name: svaha-meta-ads-strategy
    bucket: personal
    summary: >
      Svaha Tour & Travel (Mas Eko) is running a Meta Ads funnel targeting
      Australians (Sydney, Melbourne, Brisbane, Perth, Adelaide, Gold Coast),
      age 25–55, AUD $5–7/day per ad set. Funnel: Meta Ads → Landing Page →
      WhatsApp. Three campaign tiers mirror funnel stage (TOF/MOF/BOF →
      Messages CTA). Creative-first approach chosen deliberately: 11 ads
      storyboarded before any infrastructure is built. Priority 1 ads are
      "Skip the Tourist Traps" (video 15s), "What's Included vs NOT"
      (carousel), and "Coming to Bali Soon?" (static). Key infrastructure
      still pending: Meta Pixel, WP landing page, Fluent Forms, WA Business
      integration.
    paths:
      - memory/2026-07-26/svaha-fb-ads-creative-production.md
      - memory/2026-07-26.md

topics:
  - title: SumoPod remediation status — were the critical findings acted on?
    reason: >
      Two critical findings (exposed Supabase anon key, verbose error messages)
      and one high finding (public sandbox API) were flagged for action within
      24 hours. Whether those were resolved is unknown; a follow-up is
      materially important for the project's security posture.
    evidence: >
      sumopod-security-audit-findings.md — IMMEDIATE recommendations section;
      all 9 findings marked "Unresolved" at report time.
    keywords: [supabase, anon-key, rate-limiting, CORS, RLS, sumopod, remediation]
    paths:
      - memory/2026-07-26/sumopod-security-audit-findings.md

  - title: Svaha Video 1 production — Veo Omni output quality and CapCut assembly
    reason: >
      The two Veo Omni scenes for "Skip the Tourist Traps" have full prompts
      documented but generation hadn't been run yet. The next concrete step
      is running the prompts, applying the checklist, and assembling in CapCut
      with the documented text overlay timestamps.
    evidence: >
      svaha-fb-ads-creative-production.md — Scene 1 and Scene 2 JSON prompts,
      CapCut timestamp spec, and the pre-use checklist.
    keywords: [veo-omni, CapCut, anti-AI, svaha, facebook-ads, video-production, kukuhaldy]
    paths:
      - memory/2026-07-26/svaha-fb-ads-creative-production.md

  - title: QwenPaw 2.0.1 — user-editable agent modes and Oh-My-Paw loop plugins
    reason: >
      The update introduces user-configurable agent modes (iterations, stop
      conditions, approval gates) and five named loop modes (UltraQA, Ralph,
      Ultrawork, Autopilot, Team). These directly affect how Mas Eko can
      orchestrate AI workflows, which is central to the creative production
      approach documented in the same session.
    evidence: >
      svaha-fb-ads-creative-production.md — QwenPaw 2.0.1 update section,
      released 2026-07-24.
    keywords: [QwenPaw, agent-mode, Oh-My-Paw, Autopilot, Langfuse, plugin]
    paths:
      - memory/2026-07-26/svaha-fb-ads-creative-production.md
```

role: assistant