Overview
Owners get a public submission page per business, moderate incoming reviews from a dashboard, and drop a single-line script tag that renders approved testimonials anywhere via a zero-dependency vanilla-JS widget backed by a CORS API.
Problem & Context
Small businesses lack a friction-free way to collect reviews and publish them on their own site without heavy, expensive testimonial platforms.
Key Capabilities
- Magic-link / OTP passwordless authentication
- Public per-business review submission with star ratings
- Owner moderation dashboard (approve / reject)
- Single-file vanilla-JS embed widget (<3.2 KB)
- CORS widget API with dynamic brand-color theming
Engineering Notes
Zero-dependency embed widget
embed.js reads its own script tag's src to bind the API origin and renders with escaped DOM nodes — no framework, universal host compatibility.
Application-layer tenant isolation
Prisma queries filter by ownerId derived from the authenticated session (not database RLS).
XSS-safe widget rendering
User-submitted names and text are escaped via DOM text-node conversion before injection on external sites.
Verified in the Repository
Facts below are verified in the project's source repository (static code audit). They are not runtime or business metrics.
- Next.js 16 + React 19 + Prisma 6 + Supabase Auth (verified in package manifests)
- Zero-dependency embed script under ~3.2 KB
- Two-model schema (Business, Review) with composite index for widget queries
Current Status & Limitations
MVP · In Development.
- Tenant isolation is enforced at the application layer, not via database RLS.
- The in-memory rate limiter is ephemeral across serverless instances.
- Customer photo upload is modeled in the schema but not implemented.