PharmaTrack is an AI-assisted personal full-stack portfolio prototype for exploring pharmaceutical price comparison, deterministic trust scoring, authenticated application flows, data-access controls, audit-oriented records, diagnostics, and constrained AI explanations.
It is not a commercial product, healthcare provider system, pricing authority, compliance-certified application, or source of medical advice. There are no claimed external users, customer pilots, production traffic, payer/pharmacy contracts, or realized savings.
Substantial scaffolding and code were generated with Lovable/gpt-engineer tooling. The repository should therefore not be presented as wholly hand-authored. The defensible ownership story is product direction, requirements, architecture decisions, review, testing, debugging, integration, and verified modifications. Commit volume is not used as an authorship or maturity metric.
- React 19, TypeScript, TanStack Start, and Vite application
- Supabase/PostgreSQL schema and migrations
- Authentication and role-oriented application routes
- Row-level-security policies and server-side service-role handling
- Deterministic pricing and trust-score logic
- Audit, consent, suspicious-activity, and diagnostic data structures
- Sentry and PostHog integrations
- AI explanation paths constrained by application data
Implemented controls demonstrate engineering patterns only. They do not establish HIPAA compliance or authorization to process protected health information.
npm install
copy .env.example .env # Windows
# cp .env.example .env # macOS/Linux
npm run devProvide only disposable development values. Never commit .env, service-role credentials, provider keys, or production data.
npm run lint
npm run buildThe repository does not currently define an automated unit/integration test script. Administrative diagnostics are useful application checks but are not a substitute for a repeatable test suite.
A Resend API credential was previously committed in .env revisions. The current tracked tree does not contain a non-empty Resend key, and .env.example uses an empty placeholder. However, the historical credential must be treated as compromised.
Provider action required: revoke or rotate the old Resend credential in the Resend account. Until that action is confirmed, this repository is not considered fully remediated. Git history has not been rewritten, and no claim of complete secret removal is made.
See SECURITY_REMEDIATION.md for the verified local findings and remaining steps.
- No external security assessment or compliance certification
- No production data-source freshness guarantee
- No automated test suite in
package.json - AI-assisted codebase requiring careful human review
- Historical secret remains reachable until a separately authorized history rewrite, even after provider rotation
- Confirm provider-side credential revocation/rotation
- Add unit and integration tests for pricing, authorization, and server routes
- Add CI secret scanning and dependency review
- Record a reproducible local setup and diagnostic report
- Replace healthcare compliance language in application copy with precise control descriptions and disclaimers