‹ Ember & Oak: Coffee Store with Customer Accounts and Admin PanelQuality report QR-26-00136
Ember & Oak: Coffee Store with Customer Accounts and Admin Panel
Full-stack coffee e-commerce store with customer accounts and admin panel for roasters and coffee shops. Web only.
- Product ID
- B0767-52258
- Builder
- Tabassum Nisha
- Version reviewed
- 1.0.0 · released 13 Nov 2026
- Stack
- React 19.2 + Vite 7 (plain node:http API, no framework) · JavaScript (ES modules) on Node.js 22.13+ · SQLite via built-in node:sqlite (Node 22.13+)
- Built with
- Claude Code
- Review period
- 8 Nov 2026 – 13 Nov 2026 · 2 rounds of changes
- ✓AI code audit6 checks · 8 Nov 2026
- ✓Installed & run13 Nov 2026
- ✓Demo vs delivered13 Nov 2026
- ✓Final sign-off13 Nov 2026
At a glance
- !Installed and run from the delivered code — 7 of 8 checks answered yes.
- ✓Live demo compared with the delivered code — 7 of 7 checks answered yes.
- !21 of 25 promised items delivered (setup guide, example config and the rest).
- ✓Security scored 87/100 with no failing check.
- !2 open warnings — explained in part 1.
AI code audit
The full source archive was read by our AI auditor against each check. It reads the code — it does not run it; running it is part 2.
| Check | What we found | Score | Result |
|---|---|---|---|
| Secrets & credentials | No real API keys, private keys, tokens or connection strings are committed. All regex hits are placeholders, runtime-generated random values, or code reading from environment variables. Minor concerns: demo-mode credentials are published by an unauthenticated endpoint, and the demo deployment can derive passwords from a missing SESSION_SECRET. | 90 | Warning |
| Dependency vulnerabilities | Both the Node API and React Web packages ship a package-lock.json, and all frontend dependencies are pinned to exact versions with no wildcards or 'latest'. The API has no npm dependencies, which minimizes supply-chain risk. I could not verify the lockfile contents or some exact version numbers, so a small deduction is applied. | 90 | Pass |
| Authorisation & access control | Every write endpoint (products POST/PUT/DELETE, order PATCH, reset-demo) calls requireAdmin, order reads enforce owner/admin/token checks, and passwords use scrypt with per-user salt. Remaining issues are low risk: capability tokens in URLs, public listing of demo credentials in demo mode, and stateless sessions on the demo host. | 90 | Pass |
| Database access rules | Every visible query uses bound parameters, and user-facing order reads are scoped by user or token. The one string-built SQL (product UPDATE/INSERT) interpolates only a hardcoded column list. schema.sql, db.js, validate.js and pricing.js were not provided, so foreign keys, indexes, cascades and the per-row item queries could not be verified. | 80 | Warning |
| Code structure & duplication | The API is split into sensible modules (auth, validate, pricing, routes/*) and the CLAUDE.md conventions are followed. The main weaknesses are a few oversized route handlers, a duplicated sold-out/stock pattern, and a hard-coded order limiter that should live in config. | 88 | Pass |
| Build reproducibility | The project has two separate package.json files with lockfiles. Node versions are pinned consistently at 22.13+ and the Dockerfile uses 22.14. Docker and compose are coherent, but HowToSetup.md was not in the digest and a few small inconsistencies remain. | 84 | Pass |
Open warnings
Problems that did not stop the listing. They stay on the product page until a later version fixes them.
No real API keys, private keys, tokens or connection strings are committed. All regex hits are placeholders, runtime-generated random values, or code reading from environment variables. Minor concerns: demo-mode credentials are published by an unauthenticated endpoint, and the demo deployment can derive passwords from a missing SESSION_SECRET.
Every visible query uses bound parameters, and user-facing order reads are scoped by user or token. The one string-built SQL (product UPDATE/INSERT) interpolates only a hardcoded column list. schema.sql, db.js, validate.js and pricing.js were not provided, so foreign keys, indexes, cascades and the per-row item queries could not be verified.
Requirement list
What the builder agreed to deliver before uploading — 21 of 25 met.
- Complete source for both parts Met
- Pinned lockfiles for both parts Partial
- No real credentials Met
- Single example environment file Partial
- SQLite schema creates from empty Partial
- HowToSetup.md with two targets Met
- Authorisation on every write route Met
- Working live demo Partial
- Five differentiating features present in code (nice)Met
- Seed data for demo (nice)Met
- Structure and conventions guide (nice)Met
- Changelog and licence note (nice)Met
- Docker compose for the API (nice)Met
- README.md Met
- HowToSetup.md Met
- React a project file Met
- Node a project file Met
- Node a project filee Met
- a project file Met
- a project file (nice)Met
- CLAUDE.md (nice)Met
- CHANGELOG.md (nice)Met
- LICENSE-NOTE.md (optional)Met
- docker-compose.yml (nice)Met
- docs/ (optional)Met
Human review
Reviewers from the Vibe96 team in Dubai worked through each question below; a final reviewer signed it off.
Stage 1 — Installed and run from the delivered code
Completed 13 Nov 2026A reviewer installed the product on a clean machine, following only the guide that ships with it.
| Question | Answer | Reviewer's note |
|---|---|---|
| Packages restored without errors | Yes | |
| Solution builds clean | Yes | |
| Database created from the shipped script or migrations | Yes | |
| First sign-in works with the documented steps | Yes | |
| Setup guide is accurate and complete | Yes | |
| Every module in the feature list opens and works | Yes | |
| No real secrets in the archive | Yes | |
| Branding and company details can be changed without code | No |
Stage 2 — Live demo compared with the delivered code
Completed 13 Nov 2026A second reviewer checked that what the listing and demo show is what the buyer receives.
| Question | Answer | Reviewer's note |
|---|---|---|
| Demo URL is reachable | Yes | |
| Demo credentials work | Yes | |
| Demo runs the same version as the archive | Yes | |
| All five differentiators are visible in the demo | Yes | |
| Screenshots match the demo | Yes | |
| Nothing in the demo is missing from the code | Yes | |
| Datasheet claims are accurate | Yes |
Changes asked for during review
- None — approved on the first round.
- Sign-off: approved for sale on 13 Nov 2026 with 2 warnings shown publicly.
What this report covers — and what it doesn't
- It covers version 1.0.0 exactly as the buyer downloads it: the source archive, the setup guide and the live demo on the dates above.
- It is not a penetration test, a performance or load test, or a legal review of third-party package licences.
- Scores are a point in time. Libraries age; a later version is audited again and gets its own report.
- Your setup matters. Hosting, configuration and changes made after purchase are outside this review.
- How the score is made: each AI check is scored 0–100 and weighted (security counts most). A listing needs 75 or more, no failing check, and the human review passed.
- Always try the live demo before buying, and ask the builder questions from the product page.
Vibe96 FZ-LLC, Dubai, UAE. This report describes the product at the time of review and is not a warranty.