TomTom Audit Findings

# TomTom Audit TODO

> Generated by `/tomtom-audit-report` on 2026-05-29.
> Re-run this command to refresh findings. Check off items as they are fixed.

## 🔴 Critical
- [ ] **`src/main.ts:10`** Rotate the leaked TomTom API key — `8zUq7tXQCAGYapl6acvcNh5aj14K3ks0` is committed to git history (commit `48ce35c`) and is therefore permanently exposed. Generate a replacement in the TomTom Developer Dashboard, revoke the old one, and proceed with the env-var migration below before re-deploying. _Skipped by `/tomtom-audit-fix`: requires manual action in the TomTom Developer Dashboard._

## 🟠 High
- [x] **`src/main.ts:10`** Move the API key out of source. Replace the literal with `import.meta.env.VITE_TOMTOM_API_KEY`, add `VITE_TOMTOM_API_KEY=…` to a local `.env` (gitignored) and document the build-time variable in `README.md` instead of the current "set your key in `src/main.ts`" instructions.
- [ ] **TomTom Developer Dashboard (no code change)** Restrict the new key: enable per-key domain whitelisting (Referer check) for the production origin, and limit product access to only the APIs this app calls (Maps Display, Routing, Search, Traffic Incidents). Track here as a checkbox so the fix lands alongside the rotation. _Skipped by `/tomtom-audit-fix`: requires manual action in the TomTom Developer Dashboard._
- [x] **`package.json:16`** Pin `@tomtom-org/maps-sdk` to an exact version (e.g. `"0.46.13"` instead of `"^0.46.13"`). Public Preview 0.x releases can ship breaking changes on minor bumps; floating semver lets that into production silently.

## 🟡 Medium
- [x] **`src/main.ts:34,41,50`** Add timeouts and 429/5xx retry-with-backoff around `calculateRoute`, `trafficIncidentDetails`, and `search`. Default Search/Routing QPS on Pay-as-You-Grow is 5; without a retry handler a transient 429 surfaces as a hard failure to the user.
- [x] **`src/main.ts:12-13`** Wrap the top-level `(async () => { … })()` in a try/catch (or attach `.catch`) so geocode/route/traffic failures don't reject unhandled and leave the user staring at a blank map with no feedback.
- [x] **`src/main.ts:54`** Lower `limit: 20` on the along-route `search()` call to match what the UI actually renders (5–10 is usually enough). Along-Route Search is billed at the Search API tier (~$5.50/1k); shrinking result volume reduces payload and downstream rendering cost.
- [x] **`src/main.ts:34`** Pass an explicit `travelMode` to `calculateRoute({ locations: waypoints })`. The default is `car`; making it explicit prevents a silent correctness regression if this demo is ever adapted for truck/pedestrian/bike routing.

## 🟢 Low / Nits
- [x] **`src/main.ts:39`** Replace the `getPosition(waypoints[1])!` non-null assertion with a guard. If `geocodeOne` ever returns a waypoint without a position, the `!` turns it into a runtime `TypeError` instead of a handleable error.

## Notes
- **MCP opportunity (informational):** The app has no LLM/agent components, so the TomTom Maps MCP Server (`mcp.tomtom.com/maps`) is not applicable today. Revisit if you add a chatbot, copilot, or natural-language search.
- **Maps vs Orbis (informational):** Code uses the default classic Maps backend, which is appropriate for the current feature set. If you later add EV routing, area search, or richer search-along-route, evaluate switching to Orbis via the `MAPS=tomtom-orbis-maps` env / `tomtom-maps-backend: tomtom-orbis-maps` header.
- **Verify pricing against contract (informational):** Quoted Search-API rate (~$5.50/1k) is the public PAYG rate effective 2026-07-01; confirm against your actual TomTom contract before drawing cost conclusions.

## References
- [TomTom API key management best practices](https://developer.tomtom.com/platform/documentation/api-best-practices/api-key-management-best-practices)
- [TomTom pricing announcement (2026-07-01)](https://docs.tomtom.com/pricing/price-announcement)
- [@tomtom-org/maps-sdk docs](https://docs.tomtom.com/maps-sdk-js)
- [Vite env variables (`import.meta.env`)](https://vite.dev/guide/env-and-mode)