Plan B — Code Review

A hidden element labeled "NVISION" triggers handleDevExport on click. This function:

• Fetches the complete list of project files from api-platform.sticklight.com using credentials: 'include'
• Dynamically injects JSZip from an external CDN
• Creates a ZIP archive of the entire codebase and downloads it

This is a Sticklight platform dev utility left in production code. The credentials: 'include' flag transmits authentication cookies to a third-party domain — a cross-site credential exposure risk.

Fix

Remove handleDevExport and the hidden NVISION button entirely. ✓ Fixed — removed in deployment commit.

The component calls useReducedMotion(), then conditionally returns JSX early, and only after that calls useEffect and useCallback. React requires all hooks to be called unconditionally in the same order on every render.

Fix

Move the reduced-motion guard inside the useEffect/animation logic, or restructure so all hooks run unconditionally.

The form's handleSubmit calls setSent(true) and resets after 4 seconds. A comment reads: "In production, hook up to a real API". The form collects name, phone, email, company, and message — and silently discards all of it. Users see a success confirmation but their message is never delivered.

Fix

Connect to a real backend: Resend, SendGrid, Formspree, or a Cloudflare Worker that emails submissions.

const isMobile = typeof window !== 'undefined' && window.innerWidth < 768;
const NODE_COUNT = isMobile ? 30 : 60;
const CONN_DIST = isMobile ? 120 : 160;

These values are computed once at module evaluation time, not inside any React hook. They never update on resize or orientation change.

Fix

Compute inside a useState/useEffect + resize listener, or use a media query hook.

Four legacy service pages use office@plan-b.systems via window.open(). All other contact surfaces (Footer, CTASection, ContactPage) use info@plan-b.co.il. Messages sent to the wrong address may be permanently lost.

Fix

Align all CTA links to one authoritative address. Replace window.open('mailto:...') with <a href="mailto:...">.

Both components define SVG <defs> with hardcoded IDs. SVG id attributes must be document-unique. PlanBLogo.tsx already solves this with a per-instance uid via useRef.

Fix

Generate unique suffix per instance using useRef(() => Math.random().toString(36).slice(2)).

Runs an unbounded requestAnimationFrame loop with no prefers-reduced-motion check. Other components (NeuralCanvas, SVGOrbitSystem) respect this. The global MotionConfig only covers Framer Motion, not raw rAF loops.

Reads window.scrollY 60 times/second even when idle. A passive scroll event listener has zero cost at rest.

Uses role="status" with randomly generated values presented as real-time AI system metrics. Screen readers announce meaningless numbers as genuine data. Violates WCAG 3.3.2.

Uses role="menu" and role="menuitem" — these are for application context menus, not site navigation. Requires arrow-key/Home/End/type-ahead keyboard behavior that isn't implemented.

theme.css declares --font-sans: 'Heebo', 'Inter', system-ui but index.html has no font link. Typography silently falls back to system-ui on every platform.

Six legacy pages use direct Navbar import, bg-slate-950 background, cyan/blue accents, and inline footers — completely different from the modern pages' design system.

14 explicit routes, no <Route path="*"> fallback. Invalid URLs render a blank white page.

Canvas dimensions set once at mount. No resize listener. Device rotation or browser resize leaves canvas clipped.

Math.random() called inside whileInView produces different bar heights on every render/re-mount.

Fully implemented but not imported anywhere. PageLayout.tsx handles transitions directly.

Defined but never imported. TrustBar.tsx and NumbersStrip.tsx duplicate the same counter animation logic.

Uses mr-[0.3em] instead of logical me-[0.3em]. In RTL, margin-right adds space on the wrong side.

Only <title> and basic description. No Open Graph, Twitter Card, canonical link, or JSON-LD schema.

TrustBar respects reduced motion; LogoCloud (near-identical marquee) hardcodes repeat: Infinity.

Decorative background numbers positioned with physical left-8 instead of logical start-8.

Same tracking ID ev_050b10447f on two different elements. Sticklight analytics events will be misattributed.