Vivere Web Development

Read this first. Three things matter more than everything else in this document:

Your admin OS is on the public internet with its passwords inside it. vivian-admin.pages.dev serves the whole Vivian app with no Cloudflare Access, and both account credentials sit in plaintext in /vivian.js. Verified live.
You have exactly one copy of everything. The backup script has run every 15 minutes for four months and done nothing — it exits successfully when the drive is missing. There is no cloud copy.
Nothing is leaking to the web. Every .env probe returned 404. Your exposure is on-disk and in git, not on the internet. That is a much better problem to have.

Where to start

What you've built

Every live site, what it is, and whether it's healthy.

Where it lives

The folder map, and which folder maps to which live URL.

How to update

Deploy procedures — and the one site you must never deploy directly.

Starting a new project

The checklist that prevents every problem in this report.

What's at risk

Exposed, unversioned, and unrebuildable.

The backup plan

Cloudflare R2 + restic. $0.15/month.

Part I — The Estate
1. What you have built
2. Live client sites
3. Reports, pilots & internal tools
4. Broken & orphaned
Part II — The System
5. Where everything lives
6. How to update a site
7. Starting a new project
Part III — Risk
8. What is exposed
9. What has no history
10. Where the secrets are
Part IV — Resilience
11. The backup plan
12. R2 + restic setup
13. Action list
14. What is fine
15. Live project index

Part I — The Estate

In one line78 Cloudflare Pages projects across 97 hostnames. 91 return 200 with real content. Availability is not your problem — exposure is.

1. What you have built

You have built considerably more than a typical solo shop, and the scale is the first thing worth internalising. When this audit started, the working assumption was around 30 projects. The real number is 78 Pages projects serving 97 hostnames.

Category	Count	What it is
Live client production sites	~15	Real businesses with real customers — Mimi's, GVEC, The Yard, Jireh, SOL, Carniceria, TruVue, Top it off
Client reports & proposals	~25	Pitch decks, strategy reports, value reports — the sales engine
Review hubs & pilots	~20	Campaign reviews, SIGNAL pilots, showcase builds
Internal tools	~10	Vivian admin, playbooks, capability catalog, agent docs
Staging & placeholders	~8	Staging twins, intentional takedowns

Why you couldn't hold this in your head. That's not a failing — it's roughly 78 deployments built across two years while also running the client work. The problem this report solves isn't that you forgot; it's that nothing was enumerating it for you. That's now fixed, and §7 gives you the process so the next 78 stay documented.

2. Live client sites

Sec = security headers present: F X-Frame-Options · C X-Content-Type · R Referrer-Policy · H HSTS · P CSP.

Site	Status	Sec	Note
mimissweettreats.com	Healthy	`FCRHP`	The only fully-hardened site you own — and the best pipeline. Copy this everywhere.
gveventcenter.com	200	`-CR--`	No HSTS/CSP/XFO. Staging twin is cannibalising its SEO.
theyardfuncenter.com	200	`-CR--`	No HSTS/CSP/XFO.
jirehcafeandbakery.com	200	`FCR--`	Git Provider = Yes — GitHub is in this deploy path. Folder idle 109 days.
soleverydaybs.com	200	`FCRH-`	Missing only CSP. Deploy script omits `.env` from its exclude list.
vivereweb.com	200	`FCR--`	Git Provider = Yes. 17 files uncommitted for a month.
carneceria-senora	200	`FCR--`	Deploys raw from repo root — ships `admin/`, `SETUP.md`, `node_modules/`.
truvu-pilot	200	`-CR--`	Live client site with an unversioned source folder.
true-nord-photography	200	`FCRHP`	Full header set.
topitoffgj.com	Coming Soon	`-CR--`	2.7 KB holding page despite notes saying the build is live.
vivere-colorado	200	`FCR--`	Trailer site. `noindex` deliberate until the name is final.
tentacle-tide	200	`-CR--`	Void Tide β.

The header gap is one file repeated. Mimi's has a good _headers file; it was never copied to the other ~90 hosts. That's a single-file fix, not 90 separate problems.

3. Reports, pilots & internal tools

Around 45 further hosts return 200 with correct titles and a noindex tag — the bulk of your report and review-hub estate, working as intended. The seven correctly-protected ones (sol-network-report, vivere-team-strategy, vivere-ip-record, vivere-film-review, nord-soundlabs, mimis-recipe-engine, mimis-internal-wholesale) send both an X-Robots-Tag header and a meta tag. That's the pattern to copy.

4. Broken & orphaned

Host	Issue
`mimis-wholesale-pack`	404, 0 bytes — believed live, is not
`mimis-sweet-treats-staging`	404 — staging for your flagship client is dead while prod is live
`vivere-production-bible`, `gj-pro-gym`, `elswr-tattoo`	"Deployment Not Found"
`staging-dev-client-tripodi`	0 bytes

Two live sites cannot be rebuilt. mimis-catering-expansion (311 KB, titled CONFIDENTIAL) and mimis-internal-wholesale are live with no local source folder. If Cloudflare lost them tomorrow they're gone. Fix: wrangler pages deployment list, download the latest, re-home the source — or delete the projects.

Part II — The System

In one lineCode lives in Vivere Clients\, content lives in Media Channels\, everything deploys with wrangler from your machine — and one site has a special pipeline you must never bypass.

5. Where everything lives

C:\Users\sutli\Desktop\Developer\ │ ├── Vivere Clients\ ← ALL CLIENT WORK (code + sites) │ ├── Mimis Sweet Treats\ location #1 · LIVE · own repo · BEST PIPELINE │ ├── Mimis at Roadhouse\ location #2 · in progress │ ├── Vivere Colorado Food Trailer\ trailer + catering · own repo │ ├── Delta Expansion 2026\ umbrella program: master report + research │ ├── Grand View Event Center\ GVEC · own repo │ ├── The Yard Family Fun Center\ own repo │ ├── Jireh Cafe and Bakery\ own repo · Git Provider = Yes │ ├── TruVue\ Proscapeco\ Torta Roofing\ Moore Racing\ … │ └── _AUDIT-2026-08-16\ ← this audit's source files │ ├── Vivere Internal\ ← THE AGENCY ITSELF │ ├── Vivere Web Site\ vivereweb.com working tree │ ├── Finances\ ⚠ contains real financial data │ └── vivere-estate-report\ ← this report │ ├── Media Channels\ ← CONTENT (social, video, campaigns) │ ├── Mimis Sweet Treats\ the live social pipeline │ ├── Mimis at Roadhouse\ Vivere Colorado\ Vivere\ GVEC\ … │ └── mimis-menu-boards\ ← physical menu-board system (shipped product)

The split to remember: Vivere Clients\<client>\ is the website and code. Media Channels\<client>\ is the content — social cards, videos, campaign scripts. They're separate on purpose. A client with both has a folder in each.

The one thing that confused everything: your entire home folder C:\Users\sutli used to be a git repo pointed at github.com/MIMITREAT/allbizco. That's why every Claude Code session was labelled "allbizco" and why git status showed thousands of unrelated files. Archived 2026-08-16 to _git-archive-allbizco-2026-08-16 — all 135 commits preserved, reversible with a rename.

6. How to update a site

The standard case — most projects

# from the folder that holds the site files npx wrangler pages deploy . --project-name <project> --branch main --commit-dirty=true

Project names do not match domains. The Yard's domain is theyardfuncenter.com but its project is the-yard-family-fun-center. Always verify:

npx wrangler pages project list

Mimi's Sweet Treats is different. Never deploy it directly. It has a build step that strips internal docs out of the public bundle. A raw wrangler pages deploy . from that repo root would publish _docs/, internal reports, and .env.

edit files → .\build-dist.ps1 # builds dist/, fails on LEAK DETECTED → .\deploy-staging.ps1 # master.mimis-sweet-treats.pages.dev → review the staging URL → .\deploy-prod.ps1 # www.mimissweettreats.com

Verifying a deploy

Check the unique hash URL from the deploy output first — the alias can lag by a minute.
Confirm real content, not just HTTP 200. A 200 can be a stale cache.
Bust cache when rechecking: curl -s "https://…/?cb=$(date +%s)"

7. Starting a new project

This checklist prevents essentially every problem in this report. Follow it and the next 78 projects stay clean.

Create the folder in the right place — Vivere Clients\<Client Name>\ for code, Media Channels\<Client Name>\ for content
git init immediately, before the first file. A project without its own repo silently falls into whatever repo contains it
Write .gitignore first — must include .claude/, .env, .env.*, node_modules/, dist/, .wrangler/
Deploy from a subfolder, never the repo root — put the site in site/ so internal docs can't ship
Copy Mimi's _headers file — gets you CSP, HSTS, and X-Frame-Options for free
Add noindex if it's a report, proposal, pilot, or anything internal — both the meta tag and X-Robots-Tag
Use a per-project Cloudflare token, never the shared one (see §10)
Record the project name in the client's CLAUDE.md or PROJECT-NOTES.md so it's discoverable later
Verify on the hash URL before telling anyone it's live

Part III — Risk

In one lineNothing leaks to the web. But an admin app is public with its passwords inside, several confidential reports are indexable, and 8 GB of active work has no version history at all.

8. What is exposed

Host	What it is	Severity
vivian-admin.pages.dev	Internal admin OS — CRM, client milestones, calendar — no Cloudflare Access, plaintext credentials in `/vivian.js`	Critical
~~gvec-value-report~~	GVEC value & pricing in a live negotiation — missed in the Jul 18 takedown	Fixed 8/16
vivere-client-reports	Sonora Market build report + competitive analysis; text says confidential	High
elswr-proposal	Client proposal with pricing; still branded "Allbizco"	High
vivere-agent-playbook	142 KB of core internal operating IP	High
grand-view-event-center-staging	`Allow: /` + sitemap pointing at production — actively harming a live client's SEO	High
mimis-campaign-report · proscape-staging · wandell-racing-signal	Confidential or unreleased client material, indexable	Medium

Already fixed in this session: gvec-value-report taken offline — 59,556 bytes → 775, noindex set, zero pricing data exposed. The original was preserved to Grand View Event Center\_docs\recovered-reports\ first, because that project had no local source.

9. What has no history

Now that the home-directory repo is archived, these folders have no version control at all. No history, no rollback, no undo.

Folder	Size	Code files	Why it matters
`Media Channels\` — entire tree	2.5 GB	153	Mimi's live social pipeline runs from here
`Horn Venues Marketing\`	3.4 GB	147	Largest unversioned client folder; live deliverable
`Proof of concept\`	1.8 GB	448	Has a fake `.git` — no `objects/`. Looks versioned to every automated check. Highest code-file count you own.
`Vivere Web Site\`	313 MB	279	Live agency site working tree
`mimis-menu-boards\`	372 MB	57	Shipped physical product
`TruVue\`	21 MB	13	Live client site. Cheapest win here — minutes of work.
`Delta Expansion 2026\`	4.4 MB	36	Best size-to-value ratio in the list

10. Where the secrets are

The good news, verified empirically: nothing is reachable from the web. /.env returned 404 across four Pages hosts — Cloudflare doesn't serve dotfiles. Every dist/ output is clean. All 8 live client .env files are correctly gitignored. Your .gitignore discipline is sound.

Every leak found arrived by a different route:

What	Where	Action
3 Google Cloud service-account keys, non-expiring	Two loose `.json` in `Reports & Proposals\…\unsorted\`, one pasted into a notes file	Delete in GCP IAM. Nothing uses them.
Clover private token + QuickBooks client secret	Committed and pushed to the Mimi's GitHub repo (private, not public)	Rotate — needs Naomi
2 GitHub PATs + 4 Cloudflare tokens	`.claude/settings.local.json` across 9 files	Revoke all 6
1 Cloudflare token identical across 7 projects	GVEC, Mimi's, SOL, Carniceria, Jireh, vivereweb	Split into per-project scoped tokens

The structural cause worth remembering. .claude/settings.local.json stores approved Bash commands verbatim. Every curl you once approved with a token inline wrote that token permanently into the permission allowlist. Your approvals became a credential log. Nobody thinks of a settings file as a secret store — that's why it went unnoticed. Fixed 8/16: .claude/ added to 9 .gitignore files; The Yard's tracked copy untracked.

Part IV — Resilience

In one line32 GB, ~20 client relationships, every live site's source — on exactly one SSD. This is the largest risk in the audit and the cheapest to fix.

11. The backup plan

The backup you thought you had has been lying to you for four months. Run-T7-Backup.ps1 fires every 15 minutes. All 61 retained logs say the same 64 bytes: "T7 not detected on D:. Skipping this run." The scheduled task reports SUCCESS while doing nothing, because the script exit 0s on a missing drive.

Windows File History's catalog for that drive was last written 2026-04-16. There is no cloud copy. Developer\ is not in OneDrive or Dropbox. A drive failure today is a total business loss.

Why git is not the answer

Git is for source code — text where line-by-line history matters. Most of your estate is not that. 12 files exceed GitHub's 100 MiB hard block and can't be pushed at all. And binaries in git are irreversible: your own Ten4Funding is a 20.8 MB website with a 320.5 MB .git — 15× bloat, because binaries were committed and deleted. Deleting from git does not shrink git.

Use both: git for source and history, restic for survival.

The 3-2-1 rule, and where you fail it

3 copies · 2 media types · 1 offsite. You currently have 1 copy, 1 medium, 0 offsite.

12. Cloudflare R2 + restic — your chosen setup

Your dataset is ~15–18 GB deduped (41% of your content is a second or third copy of itself; restic's content-addressed dedupe collapses it). At R2's $0.015/GB:

Line	Cost
restic → Cloudflare R2, encrypted, versioned	~$0.15/mo
Private GitHub repos for the 514 MB source tier	$0
T7 external drive (owned) as fast local restore tier	$0
Total	~$0.15/mo

Why restic specifically: client-side AES-256 means Cloudflare holds ciphertext only and never sees your key. That makes it the one destination your .env files and credentials are allowed to go — never git, never Drive/OneDrive/Dropbox. Point-in-time snapshots are ransomware-resistant in a way sync services are not; sync propagates a delete or an encryption straight to the cloud. R2 also has permanently zero egress fees, so a full restore costs nothing.

Setup

# 1. install winget install restic.restic # 2. In Cloudflare dashboard: R2 → Create bucket → "vivere-backup" # Then R2 → Manage API Tokens → Create (Object Read & Write, that bucket only) # 3. environment (use your real values) setx RESTIC_REPOSITORY "s3:https://<ACCOUNT_ID>.r2.cloudflarestorage.com/vivere-backup" setx AWS_ACCESS_KEY_ID "<R2 access key>" setx AWS_SECRET_ACCESS_KEY "<R2 secret>" # 4. initialise — STORE THIS PASSWORD IN YOUR PASSWORD MANAGER FIRST restic init # 5. first backup restic backup "C:\Users\sutli\Desktop\Developer" ^ --exclude "**/node_modules" --exclude "**/dist" --exclude "**/.wrangler" ^ --exclude "**/*.mp4.tmp" --exclude "**/_git-archive-*" # 6. verify it actually restores restic snapshots restic restore latest --target "C:\restore-test" --include "*/Delta Expansion 2026/*"

Three things that void the entire plan if skipped:

Store the restic password and R2 keys OUTSIDE the backup — password manager plus a printed offline copy. If the password only exists on C:, losing C: loses the backup. This single failure mode defeats everything above.
Use a scoped R2 token limited to that one bucket. Malware on C: then can't erase your offsite history.
Run the restore drill before deleting anything. Log it in RESTORE-DRILLS.md. If that file has no entry in 90 days, you don't have a backup — you have an assumption.

Also: BitLocker To Go on the T7, because it will carry every client .env and your SSH keys in plaintext otherwise. And dev-tools\android-keystore — two tiny files — must be in the backup and the password manager. Lose them and you can never update an already-published Android app.

13. Action list

Done in this session

GitHub token revoked and verified dead (HTTP 401) Joe
Home-directory git repo archived — 135 commits preserved, "allbizco" label gone Session
GVEC value report taken offline; original preserved first Session
.claude/ + .env added to 9 .gitignore files Session
The Yard's tracked credential file untracked Session

This week

Gate vivian-admin — Cloudflare Access on the project itself, not just the custom domain. Then rotate both passwords and get them out of client-side JS Joe
Plug in the T7 drive — gets you from 1 copy to 2 today, for free Joe
Delete the 3 GCP service-account keys in GCP IAM, then shred the local copies Joe
Set up restic → R2 (§12) Joe
Revoke the 2 GitHub PATs and roll the 4 Cloudflare tokens Joe
Fix the exit 0 bug in Run-T7-Backup.ps1 so a missing drive turns the task red Session
Add noindex to the 6 remaining exposed reports Session
Set Disallow: / on GVEC staging and ProScape staging Session
git init the unversioned folders in §9 Session

Soon

Rotate Clover + QuickBooks with Naomi Joe
Convert raw-root deploys to build-to-dist/ (Mimi's is the template) Session
Split the shared Cloudflare token into per-project scoped tokens Joe
Propagate Mimi's _headers across the estate Session
Re-home or delete the two unrebuildable live sites Session

15. Live project index

Auto-generated from disk on 2026-08-16 at 18:52. 21 projects under version control, 15 without, 1 with a broken .git. Re-run the generator any time to refresh this table.

Vivere Clients

Project	Version control	Tracked	Live URL	Last touched
Carniceria Senora	repo	76	carneceria-senora.pages.dev	2026-05-21
Crosspost video	none	—	—	2026-07-12
Delta Expansion 2026	repo	55	delta-expansion-plan.pages.dev	2026-08-16
GJ Pro Gym	repo	7	—	2026-06-08
Grand View Event Center	repo	355	gveventcenter.com	2026-08-16
Horn Venues Marketing	repo	191	—	2026-08-16
Jireh Cafe and Bakery	repo	98	jirehcafeandbakery.com	2026-04-29
Mimis Sweet Treats	repo	721	www.mimissweettreats.com	2026-08-16
Mimis at Roadhouse	repo	5	master.mimis-sweet-treats.pages.dev/roadhouse	2026-08-16
Moore Racing	repo	13	—	2026-08-16
Proof of concept	FAKE .git	—	—	2026-08-16
Proscapeco	repo	81	proscape-quote-report.pages.dev	2026-07-12
SOL Everyday Bullshit	repo	131	soleverydaybs.com	2026-04-29
Ten4Funding (paused)	repo	34	tenfourfunding.pages.dev	2026-08-16
The Yard Family Fun Center	repo	231	theyardfuncenter.com	2026-08-16
Top it off Smoothie Cafe	repo	36	topitoffgj.com	2026-08-16
Torta Roofing	repo	2	—	2026-08-16
TruVue	repo	29	truvu-pilot.pages.dev	2026-08-16
Vivere Colorado Food Trailer	repo	16	vivere-colorado.pages.dev	2026-08-16
Wandell Racing	repo	20	wandel-et-engine.pages.dev	2026-08-16
_AUDIT-2026-08-16	none	—	—	2026-08-16
_BACKUPS	none	—	—	2026-05-20
_RECOVERED-ORPHAN-SITES	repo	4	—	2026-08-16
_capability-catalog	none	—	—	2026-08-08
_templates	repo	25	—	2026-08-16

Media Channels

Project	Version control	Tracked	Live URL	Last touched
Cosmic Calm	none	—	—	2026-06-17
Grand View Event Center	none	—	gveventcenter.com	2026-07-21
Hidden Lives	none	—	—	2026-06-21
Mimis Sweet Treats	none	—	www.mimissweettreats.com	2026-08-16
Mimis at Roadhouse	none	—	master.mimis-sweet-treats.pages.dev/roadhouse	—
SOL Everyday BS	none	—	—	2026-06-23
Vivere	none	—	—	2026-08-09
Vivere Colorado	none	—	—	—
Wanderers of the Cosmos	none	—	—	2026-07-01
report-deploy	none	—	—	2026-06-27

Top level

Project	Version control	Tracked	Live URL	Last touched
Vivere Internal	none	—	vivereweb.com	—
mimis-menu-boards	repo	255	mimis-menu-boards.pages.dev	—

14. What is fine — don't spend effort here

No secret is reachable from the public web. Verified, not assumed.
All 8 live client .env files are correctly gitignored. Your discipline there is sound.
Zero credentials in any git remote URL across all 29 repos.
No repo tracks node_modules/, dist/, .pem, or a real .env.
No 500s or 522s anywhere. 91 of 97 hosts return 200 with real content.
The GitHub repos are private, which meaningfully caps the Clover/QuickBooks blast radius.
The 7 GVEC takedowns worked exactly as designed. The process is good; one item slipped.
admin.vivereweb.com is properly gated. The design is right — only the coverage isn't.
Mimi's Sweet Treats is the healthiest thing you own and the template for everything else.
The T7 script and recovery runbook are genuinely well built. One bug, 20 minutes.

Verification limits. Live/revoked status of each credential was not tested — testing requires transmitting it, which was deliberately not done. Treat all as live. Duplicate detection used size + file count, not content hashing — hash-verify before deleting anything. Binary formats (PDF/DOCX) were not scanned, and Reports & Proposals\…\unsorted\ is mostly PDFs and is exactly where the loose GCP keys surfaced — it deserves a manual pass.