Integration health
Every external service this project talks to is optional. Missing credentials don't break the app — they degrade to a graceful fallback. This page shows which paths are currently live.
- ● live
Database (Neon Postgres)
requiredConnected to a Postgres instance — every authenticated flow works end-to-end.
- ● live
Auth.js (JWT)
requiredJWT session strategy configured.
- ● live
GitHub OAuth
requiredSign in with GitHub is live (recommended for reviewers).
- ● live
Google OAuth
optionalSign in with Google is live (still in Google's Testing status — only pre-registered users).
- ● live
Gemini 2.5 Flash (Knowlex)
optional/playground streams live Gemini 2.5 Flash answers. Per-IP + global budget caps in place. More →
- ● demo / fallback
Pusher Channels (realtime)
optionalbroadcast() is a no-op; board state refreshes on your own mutations. Free-tier Pusher Sandbox (200k msg/day) is enough to enable.
- ● demo / fallback
Resend (invitation emails)
optionalInvites still succeed — the accept URL is surfaced in the UI and logged to the server console; Resend delivery just doesn't fire.
Cost stance
$0/month under adversarial traffic. Full threat model in COST_SAFETY.md.
Security headers
A on securityheaders.com — rolled back from A+ (nonce + strict-dynamic) to a static CSP per ADR-0040 to fix Vercel platform-script hydration.
API contract
OpenAPI 3.1 served at /api/openapi.json, interactive reference at /docs/api.