--- description: 2 note(s) today. name: '2026-07-26' --- - [[memory/2026-07-26/sumopod-security-audit-findings.md]] name: sumopod-security-audit-findings description: Comprehensive security audit of sumopod.com revealing critical vulnerabilities: exposed Supabase anon key (expires 2062) hardcoded in JavaScript bundle, verbose error messages hinting at service_role key requirements, publicly accessible sandbox payment API (api-pay-sandbox.sumopod.com), missing rate limiting, leaked API endpoints in bundle, and CORS misconfiguration. Testing methodology included endpoint fuzzing, JavaScript bundle analysis, Supabase RLS verification, and API endpoint mapping. Positive findings include active RLS protection, Cloudflare WAF blocking path traversal, proper CSP headers, and HSTS enforcement. Complete 25-page PDF security audit report generated with 9 total findings (2 critical, 1 high, 4 medium, 2 low severity) including prioritized recommendations for immediate action (rotate Supabase keys, fix error messages, IP whitelist sandbox API) and urgent fixes (implement rate limiting, audit RLS policies, configure CORS). Report files delivered: SumoPod_Security_Audit_Report_2026-07-26.pdf (16KB) and SumoPod_Security_Audit_Report.md (11KB). Email delivery to websiteidola@gmail.com attempted but blocked by network restrictions (transfer.sh and file.io unavailable); files sent via direct file transfer interface instead. - [[memory/2026-07-26/svaha-fb-ads-creative-production.md]] name: svaha-fb-ads-creative-production description: Svaha Tour & Travel FB Ads creative production log. 11 ads storyboard+copy ready; infrastructure not yet built. Mas Eko focused on ad creative first using AI generation. Video 1 'Skip the Tourist Traps' (TOF, 15s) fully produced as 2 Veo Omni scenes (8s each, 9:16), using Kukuhaldy Nano Structure anti-AI prompts — complete JSON per scene with text_overlay_capcut timestamps documented. Video 2 'What's Included vs NOT' (MOF, Carousel 5 slide) storyboard ready, not yet executed. Full ad priority list (11 ads, 3 tiers), Meta Ads campaign targeting (Australia, AUD $5-7/day), and QwenPaw 2.0.1 update also recorded.