Admin-token ownership risk
The legacy frontend authenticated with Clerk but used an administrator Strapi token for data operations. Some mutation paths accepted record IDs without a second ownership check.
Product and architecture
A focused consolidation—not three applications stacked together
PantryLens keeps pantry management, discovery, saved recipes, meal planning and optional image assistance while removing duplicated identity and deployment boundaries.
Generated food claims
Free-form model JSON was stored and displayed with nutrition-style fields without an authoritative source or complete validation boundary.
Two-server deployment
Next.js plus persistent Strapi created two runtimes, duplicated identity and a database dependency for basic value.
Empty second archive
The second recipe ZIP contains thousands of directory entries but no file contents; no code claim is inferred from missing files.
Selected architecture
Static product shell→Local pantry, library and planner→Bounded Vercel Functions→Optional providers
| Concern | Legacy | PantryLens |
|---|---|---|
| Identity | Clerk mirrored into Strapi | No account in portfolio release |
| Persistence | Strapi/database required | Versioned browser-local state |
| AI | Direct Gemini JSON parsing | Exact-three schema plus fallback |
| Deploy | Two applications | One Vercel project |