# Muzick — audit journal

## Goal
Audit the muzick project at `/home/kami/apps/muzick/`, file Vikunja tasks for findings, and work on autonomous items.

## Progress

### 2026-07-14 — Initial audit

**Git**: initialized, initial state committed (737bf19). Fixes committed in 42474c6.

**Project structure**: 196 files — TypeScript/Fastify backend, React/Vite frontend, BullMQ workers, PostgreSQL + Redis + Typesense.

### Fixes applied
1. **AGENTS.md tech stack**: `python/fastapi` → `fastify/typescript` (was wrong)
2. **CORS**: Added `@fastify/cors` plugin to backend with env-based origin config
3. **`.env.example`**: Created with placeholder values (secrets were only in `.env` which is gitignored)
4. **`backend/src/index.ts`**: Removed dead code (empty file, `server.ts` is real entry point)

### Tasks filed
- See Homelab infra project. Key items:
  - #109: pin Docker images (NEEDS FIX — minio:latest etc)
  - #110: N+1 queries in generators (PERFORMANCE)
  - #111: image proxy SSRF guard (SECURITY)

### New critical issues found
1. **No auth on any API** — `x-user-id` header with hardcoded fallback UUID is the only identity
2. **Admin routes unprotected** — anyone can trigger scan/reindex/delete
3. **Postgres password "password"** hardcoded in docker-compose.yml
4. **Typesense API key "muzick-key"** hardcoded in docker-compose.yml
5. **SOCKS proxy IP** `192.168.1.104` exposed in .env and AGENTS.md
6. **No tests for any worker service** (1311-line enrichment.service.ts has 0 tests)
7. **Frontend never typechecked in CI**
8. **No input validation** on many routes (admin, library — `as any` casts)

### Remaining autonomous work items
- #109 — Pin Docker images in docker-compose.yml — CAN DO