Instruction file imported from sadiajahleel-coder/compliancetrackerapp (.cursor/rules/project-context.mdc). Copyright stays with the author.

ComplianceHQ — orientation for Cursor

Read before making changes, in this order:

1. MASTER_DOCUMENT.md — stack, every API route, every DB schema, every env var, known issues, deploy process
2. FEATURES.md — what's actually built, per feature, with commit references and live/partial/unconfigured status
3. BRANCHING.md — branch strategy and PR flow you must follow

Don't get burned by these

• main and staging are protected — PR-only, no direct pushes. Branch off dev as feature/<name> / fix/<name> / chore/<name>.
• No CI exists yet. Nothing runs your changes automatically — run node --check server.js and exercise the app manually before opening a PR.
• A real secret was committed to git history (JWT_SECRET, MongoDB password, VAPID keys, in the file literally named env, no dot). It's untracked now but old values are still readable in history until rotated. Only .env.example (placeholder values) belongs in git.
• The frontend is one file, public/app.html (~4800 lines, vanilla JS, no build step, no framework, no src/). An earlier React/Vite prototype was dead code and has been removed — don't reintroduce that pattern.
• Push notifications silently no-op — web-push is imported in server.js but not installed.
• File uploads are base64 strings inside MongoDB documents — hard 16MB MongoDB document ceiling, not just the app's own (inconsistent) limit message.
• Paystack billing is unconfigured — while PAYSTACK_SECRET_KEY is unset, the webhook accepts unsigned requests.