JANTRACK Frontend V1 — Hardened

Mobile-first civic accountability PWA frontend for jantrack.ajaynxt.com.

Included

• Report issue flow with client-side photo re-encoding (EXIF/GPS removed before upload)
• Personalized local feed
• Community issue tracker + support/share actions
• Community Pulse with opinion separated from factual evidence
• Representative transparency shell
• Claim-check readiness flow
• Evidence/source taxonomy
• Open-data/free-stack catalog UI
• Keep JANTRACK Alive funding UI placeholder
• PWA manifest + restricted static-only service worker
• Restrictive meta Content Security Policy
• Trusted API/image URL allowlists
• GitHub Pages workflow with least-privilege jobs and full-SHA-pinned actions
• Public-only dist/ build so tests/docs/repository internals are not deployed

GitHub Pages deployment

1. Upload the repository files and push to main.
2. In GitHub → Repository Settings → Pages, select GitHub Actions as the publishing source.
3. In Settings → Pages → Custom domain, enter jantrack.ajaynxt.com and save it. With a custom Actions workflow, GitHub ignores the repository CNAME file for domain configuration, so this Settings step is required.
4. At your DNS provider, create a CNAME for jantrack pointing directly to your GitHub Pages default hostname, e.g. YOUR-GITHUB-USERNAME.github.io (no repository path).
5. Verify the domain in GitHub before relying on the DNS record, and avoid wildcard DNS records for Pages.
6. After GitHub provisions the certificate, enable Enforce HTTPS in Pages settings.

Official GitHub references:

• https://docs.github.com/en/pages/configuring-a-custom-domain-for-your-github-pages-site/managing-a-custom-domain-for-your-github-pages-site
• https://docs.github.com/en/pages/getting-started-with-github-pages/securing-your-github-pages-site-with-https

API behavior

• On jantrack.ajaynxt.com, the frontend expects the future production API at https://api.jantrack.ajaynxt.com.
• In local development, same-origin APIs and loopback (localhost / 127.0.0.1) are allowed.
• Arbitrary API origins stored in localStorage are intentionally not supported.
• Until the backend exists, the UI remains in offline/prototype mode. Offline reports persist metadata only; selected photo bytes are not persisted in the offline queue.

Commands

npm test
npm run build

GitHub Pages deploys only dist/, generated by scripts/build-pages.mjs.

Production backend requirement

The static frontend alone is not the full public service. Real shared reports, moderation, official-data connectors, user/admin authentication, payment verification, uploads and escalation require the self-controlled backend. Backend validation must never trust client-side checks.