Dashboard
Overview of the Likeminds Meet platform.
Recent Activity
User Management
Search, filter, and manage all users on the platform.
Form Submissions
Command center for all form submissions across the platform.
Submission Map
▼ HIDEUnited States — by state
Top Countries
Geo Coverage
Manage Venues & Hosts
Venues (physical locations) and Verified Hosts (event organizers without their own venue). Switch type via the chips below.
| Type | ID | Name | Status | Tier | Contract | City | Assigned User | Partner Email | Last Activity | Actions |
|---|
Venue Analytics
Cross-venue performance comparison. Sort any column. Click a venue name to open its detail Analytics tab for the full breakdown.
| Venue | Status | Tier | Views | OMW | Arrivals | View → Arrive % | Taps (web/phone/dir) |
|---|
Manage Venues & Hosts
Independent event organizers (speed dating, comedy promoters, fitness instructors, etc.) who run events at venues without owning one. Verified hosts can create public events.
| ID | Display Name | Categories | Status | Assigned User | Created | ||
|---|---|---|---|---|---|---|---|
| Loading hosts... | |||||||
Host Analytics
Cross-host metrics. Per-host detail lives on the Host Detail panel Analytics tab.
Top Hosts by Event Count
Loading\u2026
Top Categories
Loading\u2026
Manage Content
All Events, Plans, and Specials across the platform. Click any card to open the parent Venue or Host detail panel for edit/cancel actions.
| Type | ID | Title | Status | Owner | Schedule | Created | Actions |
|---|
Venue Pipeline
Track and manage venue partner leads from first contact to signed partner. Auto-Discovered leads (leftmost column) auto-populate when a user creates a plan or event at a non-partner business chosen via place search — deduped by business, with plan/event counts and unique users tracked (businesses already linked to a partner venue are skipped). Empty until the first qualifying plan/event is created.
Cobranding & Promotions
Generate co-branded marketing materials and venue landing pages.
Venue Brand Setup
Enter venue details to generate co-branded preview materials. All previews include a watermark until the venue signs on.
Custom Venue Landing Page
Generate a co-branded landing page for any venue. Includes QR code.
Social Media Manager
Generate, review, and manage social media content across all platforms.
Content Generator
🔥 Trending Now — click to expand
Select trends to weave into your posts. Politics & religion excluded.
📋 Your Prompt — Copy to Claude.ai
Click "Generate Prompt" above to create your prompt.
1. Copy the prompt above → 2. Open claude.ai → 3. Paste it → 4. Copy Claude's response → 5. Paste below
📥 Paste Claude's Response
Content Calendar
Coming soon — scheduled posts will appear here.
Brand Settings
Configure your brand voice and content strategy
🌿 Brand Identity
🎤 Tone & Voice
🎯 Target Audiences
📌 Current Phase & Goals
🚫 Avoid List
💬 Key Phrases
📋 Content Rules (editable — these feed directly into prompt generation)
🎯 Content Mix
🔧 Tool Assignment
🟢 Wristband Scenario Rules
⭕ Wristband Appearance
📍 Setting Diversity
🎬 Video Rules
📱 Platform Tone
🚫 Never Do
Email Communications
Manage all automated email notifications.
Email Notifications
▶ Smart Tags Reference — variables you can use in any template body / subject
Wrap any variable in double curly braces ({{name}}) and the server replaces it before sending. Empty / missing values render as a blank string.
| {{orderNumber}} | Order # (e.g., LM-20260430-0001) |
| {{customerName}} | Customer first name (or "there" fallback) |
| {{email}} | Customer email address |
| {{recipientEmail}} | Same as {{email}} — used in unsubscribe footer |
| {{phone}} | Customer phone (rarely used) |
| {{items}} | Server-rendered HTML rows (name + size + qty + price). Drop into a <tbody> or <table>. |
| {{shipAddress}} | Full ship-to address as HTML (name + street + city, state zip) |
| {{subtotal}} | Pre-discount subtotal $ |
| {{shipping}} | Customer-charged shipping ($X.XX or "Free") |
| {{tax}} | Sales tax $ |
| {{total}} | Order total $ (or "Free (promo applied)") |
| {{discountRow}} | Pre-rendered HTML <tr> for promo discount (or empty if no promo) |
| {{promoCodeRow}} | Pre-rendered HTML <tr> showing promo code (or empty) |
| {{paymentMethod}} | Friendly label ("Card ending 4242", "Free / Promotional", "Venmo", etc.) |
| {{trackingNumber}} | USPS tracking # (only set after label created) |
| {{trackingUrl}} | Clickable USPS tracking link |
| {{exceptionMessage}} | Customer-friendly text for delivery exceptions ("held at PO", "no access", etc.) — only set in the Delivery Issue template |
| {{refundAmount}} | Refund $ amount |
| {{refundReason}} | Refund reason text (admin-entered) |
| {{date}} | Auto-fills today's date if you don't set it |
| {{status}} | Order status string (rarely needed in customer email) |
A reference variable that's not set on a particular order renders as an empty string — no broken {{like.this}} in the email body.
Source of truth: Brevo (since 2026-06-06). Edit email content directly in Brevo's WYSIWYG editor — click View in Brevo ↗ on any row. Your edits are live and are never overwritten by deploys.
The app routes every templated email to its Brevo template via config/shipping.brevoTemplateIds (camelCase keys, matching what the server passes to sendTransactionalEmail). The inline build (email-templates/build.js → functions/email-templates-built.js) is retained only as a last-resort fallback if a Brevo template is unavailable.
All rows below are routed through Brevo.
| Trigger | Provider · Brevo ID | Status | |
|---|---|---|---|
| Orders | |||
| Order Confirmation | When order paymentStatus = paid OR free (Square / promo / admin manual) | Brevo · #19 View in Brevo ↗ | |
| Your Order is on the way! | First in-flight email — fires on carrier acceptance OR first transit scan | Brevo · #20 View in Brevo ↗ | |
| Out for Delivery | When package is on delivery truck | Brevo · #21 View in Brevo ↗ | |
| Delivery Confirmation | When tracking shows delivered | Brevo · #22 View in Brevo ↗ | |
| Delivery Exception | When USPS reports an issue | Brevo · #23 View in Brevo ↗ | |
| Refund Processed | When refund is issued via Square (Square also sends its own Refund Receipt automatically) | Brevo · #24 View in Brevo ↗ | |
| Return Instructions | When admin issues return label/instructions to customer | Brevo · #29 View in Brevo ↗ | |
| Return Requested | When customer's return request is received (acknowledgement) | Brevo · #30 View in Brevo ↗ | |
| Return Denied | When admin denies a return request (with reason) | Brevo · #31 View in Brevo ↗ | |
| User Comms & Auto-replies | |||
| Waitlist Confirmation REQUIRED | When user joins waitlist (Step 1) — magic-link branded email | Brevo · #25 View in Brevo ↗ | |
| Venue Partnership: Auto-reply | Form-submission auto-reply when venue submits a partnership inquiry form | Brevo · #37 View in Brevo ↗ | |
| Careers: Auto-reply | Form-submission auto-reply when candidate submits a job application | Brevo · #38 View in Brevo ↗ | |
| Feedback: Auto-reply | Form-submission auto-reply when user submits the feedback form | Brevo · #39 View in Brevo ↗ | |
| Authentication | |||
| Email Verification Link REQUIRED | Branded email-verification link via sendEmailVerificationLink CF — replaces Firebase Auth's default plain-text mailer (Path A: caller has email; Path B: phone-only user with Firestore email) |
Brevo · #26 View in Brevo ↗ | |
| Password Reset Link REQUIRED | Branded password-reset link via sendPasswordResetLink CF — privacy-preserving (no enumeration leak when email is unknown) |
Brevo · #27 View in Brevo ↗ | |
| Email Link Sign-In REQUIRED | Branded passwordless magic-link sign-in via sendEmailLinkSignIn CF — auto-restores accounts in 30-day pendingDeletion grace window |
Brevo · #28 View in Brevo ↗ | |
| Admin Actions | |||
| Venue Partner Invite | When admin sends invite via venue Workflow tab | Brevo · #32 View in Brevo ↗ | |
| Venue Partner Rejection | When admin rejects a pending venue submission | Brevo · #33 View in Brevo ↗ | |
| Host Partner Welcome | When admin approves a Become-a-Host application | Brevo · #34 View in Brevo ↗ | |
| Host Partner Rejection | When admin denies a Become-a-Host application (with reason) | Brevo · #40 View in Brevo ↗ | |
| User Invite | When admin manually creates a user via "+ Add User" — single template renders dynamically per role (venuePartner / admin / superAdmin / member) | Brevo · #35 View in Brevo ↗ | |
| Internal / Operational | |||
| 📊 Daily Cost Monitor | Per-function invocation counts (24h/7d/14d/30d/90d/180d/365d). Catches runaway invocations within 24h per Rule 0.6. | Brevo | |
| 🚨 CostGuard Alerts | Proactive scan every 30 min. Emails ONLY when cost-cascade signals detected (missing Firestore indexes, API quota exceeded, function timeouts, permission denied). 24h de-dup so no spam. | Brevo | |
| 📋 Index Health Alerts | Daily 02:00 UTC: reconciles firestore.indexes.json against production. Emails on drift detection (declared-not-ready or production-not-declared). Off-switch for the daily fire — manual Verify Indexes button on Cost Monitor card always works regardless of toggle. |
System (raw HTML) | |
| 🔬 Schema Validation Alerts | Weekly Sunday 02:00 UTC: samples 50 docs/collection against functions/_schemaRegistry.js. Validates Rule 23 camelCase + required/deprecated/type checks. Emails on drift findings. |
System (raw HTML) | |
| Trigger | Provider · Brevo ID | Status | |
|---|---|---|---|
| Payment Receipt | Automatic when payment processes | Square | Managed in Square Configure in Square → |
| Refund Receipt | Automatic when refund processes | Square | Managed in Square |
App Notifications
Send test pushes, targeted broadcasts, view per-user delivery audit, and manage notification template copy.
Send Test Push
Send a single push to a specific user. Useful for QA + verifying push tokens are registered. Rate-limited 50/h per admin. Audit-logged.
Send Broadcast
AND-composable targeted fan-out. Set filters, click Preview Count, set push content + type CONFIRM_BROADCAST, then Send. Capped at 10,000 recipients. Rate-limited 5/day per admin. Audit-logged before send.
CONFIRM_BROADCAST to authorize.Per-User Audit
View last 50 push attempts for a specific user. Useful for "I never got the push" complaints. Reads from pushNotifications collection (90-day retention; older history available only via BigQuery export).
Products
Manage your shop inventory, pricing, and sale strategies.
Orders
View and manage customer orders.
Promo & Discount Codes
Create, manage, and track promotional codes and discounts.
| Code | Type | Applies To | Uses | Status | Created | Actions |
|---|---|---|---|---|---|---|
| Loading promos... | ||||||
Referrals
Manage referral leaderboard and configure rewards.
Referral Leaderboard
| Rank | Name | Referral Code | Referrals | Last Referral | |
|---|---|---|---|---|---|
| Loading... | |||||
📊 Cost Monitor
Health snapshot at top. Scroll for details. GCP $ from BigQuery (actual). Non-GCP $ computed from usage × per-call pricing (exact for linear-priced APIs; "—" for tier/token/transaction-based).
🩺 Health Snapshot
💰 GCP Cost Detail (rolling windows)
Rolling 24h/7d/30d from BigQuery. Includes only Google Cloud services. Non-GCP totals shown separately below in External APIs.
| Last 24h | Last 7d | Last 30d | |
|---|---|---|---|
| 💰 Actual billed (rolling) | — | — | — |
🔥 Firebase Usage (live quota tracking)
Today's actual usage vs free-tier daily limits. ● under 50% · ● 50-90% · ● over 90% (paying)
⏳ CostGuard — checking…
Scanning Cloud Logging for cost-cascade signals (missing indexes, quota exhaustion, timeouts, permission errors).
📊 Cloud Monitoring Alerts — click Refresh to load
10 alert policies active (Firestore reads/writes/deletes/listeners + Cloud Run invocations/errors/latency + Storage egress + Auth signins + App Check failures). Branded emails route to reports@likeminds-meet.com; recent fire history below.
⏳ Index Health — click Verify to check
Reconciles firestore.indexes.json against production composite indexes via Firestore Admin API. Daily auto-check at 02:00 UTC.
🧹 Sweeper Health — click Refresh to load
14 daily soft-delete sweepers (04:00-05:10 UTC staggered). Each respects global killAll; defensive filters keep paid+shipped+refunded orders forever (purgeAbandonedCarts).
🔥 Firebase Cloud Functions
● Live · rolling 24hClick any column header to sort (default: 24h calls descending). Each period column shows invocation count for that window — the 24h column is rolling from now, refreshed every time you hit ↻ Refresh. Status: ● Active = currently deployed; ● Deleted = function gone but historical metrics remain (sorted to the bottom).
💡 Per-function cost: Standard BigQuery export rolls all Cloud Functions cost into one "App Engine" SKU. The Detailed export you just enabled adds system_labels.cloud_function_name — once it populates (~24h after enabling), this table will show real $ per function. Total Cloud Functions cost is in the GCP Cost Detail card above (under "App Engine" service).
| Function | Status | Description | Mem | Avg ms | 24h | 7d | 14d | 30d | 90d | 180d | 1y | WoW |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Click ↻ Refresh Now to load data. | ||||||||||||
🔌 External APIs
Click any column header to sort (default: 24h calls descending). Each period column shows API call count. 30d cost = exact math (calls × per-call price after free tier) for linear-priced APIs; "—" for tier/token/transaction-based services. Free Tier = threshold before paid pricing kicks in.
| Service | Description | 24h | 7d | 14d | 30d | 90d | 180d | 1y | 30d cost | Free tier | Paid pricing | Dashboard |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Click ↻ Refresh Now to load data. | ||||||||||||
📊 MAU Calculator (forecasting tool — admin only)
Plug in a target MAU number — every row in the tables above gets a projected-calls + projected-cost column. Math: projected_calls = MAU × callsPerMau, cost = max(0, calls − free tier) × per-call price. Defaults are hand-curated; admin/scheduled functions = 0 (don't scale with MAU).
✅ BigQuery billing exports configured
Standard usage cost: ✅ enabled — powers the GCP Cost Detail card.
Detailed usage cost: ✅ enabled — adds resource-level attribution (system_labels.cloud_function_name etc). First Detailed data ~24h after enabling. Once it populates, the Cloud Functions table will show actual $ per function.
Pricing: ⊘ disabled (not needed — we have actuals).
Moderation & Reports
Single hub for ALL reports — AI-flagged content, user-vs-user reports, accounts under review, and restricted-zone false-positive reports.
| Date | Type | User / Subject | Summary | Flags / Reasons | Status | Actions |
|---|---|---|---|---|---|---|
| Loading unified moderation queue… | ||||||
External Events Moderation
Ticketmaster + SeatGeek + Eventbrite events synced into externalEvents/ collection. Sections below are grouped by status. Most events fall under "Standalone" — meaning the dedupe algorithm reviewed them and didn't find a match (these are unique events, no admin action needed). Click a section to expand it.
hidden:true flag set by an admin. Doesn't affect dedupe state.hidden!==true AND archivedByDedupeAt===null must be true. An event can be invisible for either OR both reasons; check the badges on each card to see which.Loading external events...
Manage Restricted Zones
Polygon-defined areas where Plans and Events are blocked or warned at create-time. Sourced from OpenStreetMap (FAA SUA removed 2026-04-24). Admin-managed zones override category defaults.
+ Add Custom Zone (this page) = ADDS a NEW restricted area. E.g., a hospital that OSM doesn't know about → draw polygon → mark HARD. Plans/events created inside will be BLOCKED.
+ Add Exception (Exceptions page) = WHITELISTS an area inside an existing zone. E.g., a converted school building that's now a public event center — OSM tags it as "school" (HARD), but you want plans/events ALLOWED there → draw polygon over the event center → category=school. Future creates inside will SKIP the school block.
They're inverse operations. Custom Zone ADDS restrictions; Exception REMOVES them locally.
Category Toggles
The central control surface. Set HARD / SOFT / OFF per category. Save propagates the change to all matching zones in the database.
- HARD = Plans/events at this location are BLOCKED with no override option for users. Creators see "Oops, plans can't be created at this type of location." Server refuses the write. Use for: airports, prisons, military bases, hospitals, K-12 schools, etc.
- SOFT = User gets a WARNING + must explicitly confirm. "Heads up — this looks like it may be near or inside a [category]. Are you sure?" → user taps Yes → plan/event creates. Use for: cemeteries, churches outside service hours, etc.
- OFF = Zone exists in database but is INERT. No block, no warning. Used to ingest data without enforcing yet (e.g., test new categories before flipping live). Stays available for future toggle to HARD/SOFT.
- ENABLED (checkbox) = Whether this CATEGORY is even being processed at all. Unchecking ENABLED is different from setting OFF: Unchecked = category is fully ignored, won't be re-imported on next OSM refresh, existing zones stay in DB but the importer skips. OFF = imported but inert. Use ENABLED to permanently retire a category; use OFF to pause one.
onRestrictedZoneCategoryConfigChange trigger). Plans/events created at those zones get the new severity immediately.
Geographic Exceptions
Whitelist specific real-world locations even when they match a HARD category (e.g. converted-school event center, historic fort that's now a public park).
school by OSM but genuinely okay.
+ Add Exception (this page) = WHITELISTS an area inside an existing HARD zone. E.g., a converted school building → polygon over the event center → category=school. Future plans/events created INSIDE the polygon SKIP the school block. The underlying zone stays in place; the exception just creates a "carve-out".
+ Add Custom Zone (Manage Zones page) = ADDS a NEW restricted area. E.g., a missing hospital → draw polygon → mark HARD. Plans/events inside will be BLOCKED.
They're inverse operations. Custom Zone ADDS restrictions; Exception REMOVES them locally.
Activity Log
Every block, soft-warn, soft-confirm, force-override, and external source bypass is logged here. 7-year retention per data policy.
Zones Under Review
Imported zones that failed an objective data-quality gate are held here for human review instead of being silently dropped or enforced as-is. Approve promotes a legitimate zone (e.g. a genuinely huge but real military range) to live enforcement; Reject dismisses a bad one (e.g. a mislocated foreign feature). Flag reasons: impossibleSize = bounding box too large to index even at the coarsest tile (corrupt / globe-spanning geometry); outOfRegion = centroid far outside the state it was queried for.
Connected API Services
Rotate API keys and credentials without editing code. Changes take effect within 30 seconds. Super-admin access required.
Admin Tools
One-shot migrations and backfills. Run manually; each is safe to re-run (idempotent).
geohash on every event doc. Geocodes events with address but no lat/lng. Takes ~60-90s for ~3000 events. Requires googleMapsApiKey saved + tested above.blockedByMe[] on every user doc — the inverse of blockedUsers[]. Powers the replacement for the old collection-scan in useNearbyUsers (scales to 10k+ users). Iterates users in paged batches of 500. Takes ~30-60s for ~10k users. Idempotent.config/restrictedZoneCategories from the canonical 107-category source-of-truth table in functions/index.js. Use after editing the table in code (e.g. flipping a default severity). Overwrites any in-Firestore admin edits — re-apply category toggles after re-seeding.externalSources[]; archived dupes get archivedByDedupeAt + archivedByDedupeCanonicalId + deduplicationGroupId (per SQ-005 EM-T1-27, archived dupes no longer set hidden: true — admin "Unhide" intent now preserved across dedupe runs). Idempotent — safe to re-run. Cursor at Firestore config/dedupeBackfillState.
- Browser tab must stay open the entire time.
- Computer must NOT sleep.
- Each chunk = ~1 to 30 seconds (one 7-day window of events). The button auto-loops the next chunk automatically.
- Total drain depends on how far in the future events extend (typically <1 year for external sources). Most runs finish in under 5 minutes.
- Closing the tab stops the drain. No autonomous billing — work pauses cleanly. Re-clicking resumes from cursor.
- Subsequent automatic dedupes happen every 6h via
dedupeExternalEventsScheduledpubsub — this button is for the initial backfill or after the match algorithm is tuned.
Dev Tools — Feature Toggles
Pre-launch testing toggles. Each flips a behavior in production CFs that’s normally locked down. Use carefully — toggles ON are NOT production-safe. Cache TTL is 60 seconds, so runtime-flag changes take effect within ~1 minute — except the Performance (min-instances) toggles, which apply only on the next functions deploy.
config/featureToggles Firestore doc.
venuePartner accounts are excluded from discovery surfaces (map dots, missed connections, crew suggestions, attendee lists, etc.) per Rule 19. As of 2026-06-03, admin / superAdmin DO appear as normal user dots (Rule 19 narrowed to venuePartner-only — team accounts are real people; only venue-partner business accounts stay off the map, surfacing as venue pins per Rule 20).When ON:
venuePartner also participates in discovery the same as role: 'user' accounts. Lets you test the full discovery flow including venue-partner accounts without spinning up fresh test accounts._computeProfileCardForViewer, getUserUpcomingPlans, searchUsersByFirstName, getVenuePresenceList, logMissedConnection (caller + target), onUserLocationWriteVisibleProfilesFanOut, onUserProfileChangeFanOutUpdated (visibleProfiles purge), backfillVisibleProfiles, expressInterest (Say Hi target), sendNetworkInvite (Add to Network target), openMessage (Open Message target).verifiedHosts.activePromo, events.promo, events.hostActivePromo. The unified specials/{specialId} collection (Phase 2-9) is the canonical replacement; these legacy values are unreachable. Founder direction 2026-06-08: clean-cut delete, no migration of legacy values (Phase 18 alternative skipped — pre-launch posture, all current values are null).Dry-Run shows the count without writing. Live Scrub issues
FieldValue.delete() on every match (paginated 500/page, idempotent, audit-logged to Cloud Logging). Safe to re-run; the existence guard skips already-clean docs. Backed by the adminPurgeEmbeddedPromoFields CF (superAdmin only, 5/h rate limit).onUserPrivacySettingsPropagateCreated/Updated triggers and force-recomputes a single user’s userLocations/{uid}.effectiveScope + permittedReadUids from canonical source-of-truth (their requestReceiveScope, hideMapFromRequesters, and current network/crew membership).Use case: the trigger correctly short-circuits when neither privacy field changed — but it does NOT fire when the user’s underlying network changes (new mutual matches, lost connections, crew membership changes). If a user’s
permittedReadUids has drifted behind their actual network, this lever forces a fresh compute.Backed by the
adminForceRecomputeUserLocationPermissions CF (admin only, rate-limited 60/h per actor, kill-switch gated, audit-logged to adminEventLog).onRestrictedZoneCategoryConfigChange trigger and force-recascades a single category’s canonical severity + enabled values from config/restrictedZoneCategories to every matching doc in restrictedZones.Use case: the trigger correctly short-circuits when neither severity nor enabled changed — but if downstream zones have drifted from the canonical config (manual database edit, partial deploy, cascade race), this lever forces a fresh re-cascade.
Backed by the
adminForceRecascadeRestrictedZoneCategory CF (admin only, rate-limited 60/h per actor, kill-switch gated, audit-logged to adminEventLog). Dropdown loaded from config/restrictedZoneCategories.userLocations doc and force-recomputes permittedReadUids from canonical source-of-truth (Network mutuals + matched Say Hi connections + crew memberships, per user’s privacy scope).Use case: closes the deploy-gap for the 3 new auto-watcher triggers (
onUserNetworkChange / onCrewMembershipChange / onConnectionMatchChange). Those triggers only fire on NEW state changes — relationships that existed BEFORE the trigger deploy carry stale perms until next change. Run this once post-deploy.Paginated (100/batch), idempotent (safe to re-run), audit-logged to
adminEventLog. Backed by the backfillUserLocationPermissions CF (admin only, rate-limited 10/h per actor, 540s timeout, 512MiB).counterShards/0 with the parent’s current flat-field value, across all 10 sharded parent collections (events / externalEvents / venues / venuePipeline / config/counters / photoHashes / users / demoLinkPerformance / photoModerationSpend / demoAnalyticsRollups).Use case: belt-and-suspenders companion to the trigger’s built-in self-healing bootstrap. The aggregator trigger auto-seeds shard 0 with the parent-vs-shard-sum gap on first write per doc; this CF runs the same seed across EVERY parent doc up-front, eliminating the per-doc bootstrap detour. Recommended ONCE post-ADR-#3-deploy, then on demand if shard/parent drift is ever suspected (admin Cost Monitor or schemaValidation drift report).
Per-collection paginated (100 docs/page), idempotent (safe to re-run — no-op when shard sum already matches parent), audit-logged to
auditLog. Backed by the adminSeedAllShardedCounters CF (superAdmin only, rate-limited 20/h, 540s timeout, 512MiB, maxInstances:2 + concurrency:1 — single execution at a time prevents shard double-seeding races).Security Monitoring — Incident Review
Every hardened CF logs abuse-detection events (App Check missing, honeypot tripped, time-on-form too short, validation failed, rate-limit hit, kill-switch active) to securityIncidents. This panel surfaces them for post-launch monitoring. IPs are sha256-hashed (no raw IP storage; GDPR-safe). Spikes from a single ipHash indicate active abuse attempts; investigate via Cloud Logging filter on the CF.
| Time | CF | Incident | IP Hash | Detail |
|---|---|---|---|---|
| Loading… | ||||