openalice-landing

Static site with minimal attack surface, but WAITLIST_EXPORT_TOKEN undeclared in manifest suggests untracked secret; no evidence of CSP/security headers or rate-limiting on any waitlist endpoint implied by that token.

No tables owned and no backend declared, yet WAITLIST_EXPORT_TOKEN and NEXT_PUBLIC_EMBED_API_BASE hint at data-collecting endpoints whose schema/GDPR handling is invisible — scored conservatively on absent evidence.

Manifest present with valid summary and endpoint declaration, but README excerpt is empty, roadmap scored 30/100 by Atlas, and no in-code architecture notes are evidenced.

Health probe returns error (connection refused to openalice.eu), 0.0% uptime over 24h — the production site is unreachable, which is a fundamental reliability failure regardless of static-site simplicity.

Health probe itself fails with connection error; no evidence of structured logs, metrics, or tracing; for a static site the bar is lower but a working health endpoint is the minimum and it is absent.

Inspector not run and no local clone available; zero evidence of any test suite — no test count, no coverage data, no CI status (reported as '?'); graded on absence of signal.