# Pitfalls

## Entry Template

```
date: YYYY-MM-DD
author: <agent|name>
scope: <files/routes/features>
type: pitfall
rationale: <why recorded>
impact: <user/system/security/i18n/a11y>
status: open|mitigated|resolved

Pitfall:
How to detect:
How to avoid:
```

---

### PF-001: Locale Rewrite Drift

date: 2026-03-11  
author: Cline  
scope: `next.config.js`, `i18n.js`, user-facing routes  
type: pitfall  
rationale: Route/content parity can silently break across EN/CY if only one side is updated.  
impact: Broken navigation and inconsistent bilingual experience.  
status: mitigated

Pitfall:
Adding or modifying a route in one locale without corresponding rewrite/translation updates.

How to detect:

- Manual navigation check for EN and CY aliases.
- Verify page namespace mappings in `i18n.js`.

How to avoid:

- Treat route + translation + rewrite as one change unit.

### PF-002: Sensitive Logging in Auth/Notification Paths

date: 2026-03-11  
author: Cline  
scope: `pages/api/auth/[...nextauth].js`, `pages/api/email/**`, `actions/index.js`  
type: pitfall  
rationale: Debug logs in these paths can expose identifiers or callback tokens.  
impact: Security and privacy risk.  
status: open

Pitfall:
Verbose console logs around auth URLs, email payloads, or user identifiers.

How to detect:

- Search changed files for `console.log` and inspect payload content.

How to avoid:

- Use redacted logging and avoid printing callback tokens/user-sensitive data.