# pisa.maahir.io — Full QA Report

**Date:** 30 Sep 2026  
**Tester:** X2 (via CamoFox browser)  
**Stack:** Next.js (App Router), PostgreSQL (status: UP via API, "down" in UI), AI/MiniMax (status: DOWN — real)  
**Campaign:** Cyber Secure Pakistan — 1-31 October 2026  
**Uptime:** ~2.6 days continuous; last backup today 03:20 UTC

---

## 🔴 CRITICAL (must fix before launch / before October 1)

### B1. /verify returns 404 — Certificate verification is BROKEN
**Severity:** CRITICAL  
**Page:** https://pisa.maahir.io/verify → "404 — This page could not be found."  
**Impact:** Certificates are the platform's core promise ("QR-Verified Certificates" marketed everywhere). Footer links to it from every page. CTAs reference "verify" but the page doesn't exist.  

**Action:** Build /verify — accept certificate ID or scan QR, show holder name, course, date, score, status (active/revoked).

---

### B2. /ctf returns 404 — CTF platform link is broken
**Severity:** CRITICAL  
**Page:** https://pisa.maahir.io/ctf → "File not found" (CTFd instance, no index)  
**Impact:** Dashboard, events page, roleplay, and homepage all link to /ctf. The dashboard's "🚩 CTF Platform" quick tool is a dead link. A "National CTF Qualifiers (youth)" event on Oct 24 points users to a non-functional page.  

**Action:** Either mount CTFd at /ctf path, create a landing redirect, or remove the broken links. CTFd is installed (subdomain ctfd.pisa.maahir.io?) — needs proxy / subdomain pointer.

---

### B3. /status page UI is WRONG — shows "Postgres down" when DB is UP
**Severity:** CRITICAL (misleads users + admins)  
**Page:** https://pisa.maahir.io/status  
**What UI shows:** `✗ Postgres down   ✗ AI (MiniMax) down   ✓ App online`  
**What API says (`/api/status`):** `{"status":"degraded","services":{"db":true,"ai":false,"app":true}}` — DB is true.  

**Action:** Fix the /status page renderer. It's reading the wrong field or doing an inverted boolean on `db`. Most likely a `services.db` ↔ `services.ai` field swap or an inverted ternary.

---

### B4. AI/MiniMax is genuinely DOWN (per API)
**Severity:** CRITICAL for AI features  
**Page:** https://pisa.maahir.io/status  
**What API says:** `services.ai: false` — AI is offline.  

**Impact:** AI Scam Drill (/roleplay) is the platform's flagship differentiator. If AI is down, the drills fail silently or hang. OpenCTI lab (cti.pisa.maahir.io) is also AI-dependent.  

**Action:** Check MiniMax provider config + API key. Restart the AI service. Confirm `/api/status` recovers `ai: true`.

---

## 🟠 HIGH (fix this week)

### B5. /dashboard is publicly accessible without authentication
**Severity:** HIGH (UX issue + minor data leak)  
**Page:** https://pisa.maahir.io/dashboard (no login required)  
**What happens:** Anyone hitting /dashboard URL sees a fully-rendered "Demo" dashboard with name "Demo", "Cyber Recruit" level, "0 XP", recommended course, my activity, my exams, certificates (0), badges (0), quick tools, sign-the-pledge CTA. The "Logout" button is also rendered.  

**Root cause:** The /dashboard route is rendering a static demo page or doesn't check auth state. After login (with demo creds), no cookies/localStorage are set, but the page shows anyway. Either the page is hardcoded to render the demo state, or Next.js middleware is missing for /dashboard.

**Action:** Add server-side auth check on /dashboard and /dashboard/*. Redirect to /login if no session cookie. The /admin route does this correctly (redirects to /login).

---

### B6. /dashboard/security is publicly accessible — exposes "Delete my account" + "Download my data"
**Severity:** HIGH (security UX)  
**Page:** https://pisa.maahir.io/dashboard/security  
**What happens:** Page renders fully without auth. Shows "OFF" 2FA status, all email-pref checkboxes, "Download my data (JSON)" link, "Delete my account" button.  

**Note:** The data-exports API (`/api/me/export`) DOES return 401 unauthenticated, so data is safe at the API layer. But the page itself is misleading and would let an attacker social-engineer clicks (the buttons are visible but might be no-ops for unauthed users — needs source check).

**Action:** Same as B5 — add auth middleware to /dashboard/*. Or at minimum, render a "Please log in" message when no session.

---

### B7. Login form accepts demo creds but does NOT set a session
**Severity:** HIGH (auth broken)  
**Page:** https://pisa.maahir.io/login  
**What happens:** Submitting `demo@pisa.org.pk / Demo-Pisa-2026!` (or GCSAP demo) redirects to /dashboard, but no cookie is set, no localStorage, no JWT. Reload = logged out. Header still shows "Login / Register Free" everywhere.  

**Action:** Investigate login API. Either:
- Set-Cookie header missing on login response
- Cookie is HttpOnly (good) but not being sent back correctly
- Login is bypassing real auth and just routing to a mock page

---

### B8. /pledge wall shows 6 duplicate "E2 E2E T." entries
**Severity:** MEDIUM (visible to public)  
**Page:** https://pisa.maahir.io/pledge  
**What it shows:** "E2 E2E T. · Karachi" appears 6 times before the legitimate "AM Ammar J. · Islamabad".  

**Likely cause:** No de-duplication by name+IP. Either someone tested 6 times, or the form is double-firing per submit (count went from 7 → 8 after my single POST, so it's NOT auto-firing on submit — it was a tester submitting 6x).  

**Action:** Add rate limit + dedup (same name + same IP within X minutes → reject or replace). Or convert to a "pledgers" tally with recent names only.

---

### B9. "Cybercrime? Call 1799" CTA on /status goes to wrong WhatsApp link
**Severity:** MEDIUM (public-facing, wrong info)  
**Page:** https://pisa.maahir.io/status → "💬 Cybercrime? Call 1799"  
**What it links to:** `https://wa.me/?text=Hello%20PISA%20support` — a generic WA prefill to no number.  

**Action:** Change to either `tel:1799`, the actual NCCIA complaint URL (`complaint.nccia.gov.pk`), or a real PISA WhatsApp number. NOT a WA placeholder.

---

## 🟡 MEDIUM (polish)

### B10. /register "Try demo" link goes to /gcsap — wrong destination
**Severity:** LOW  
**Page:** https://pisa.maahir.io/register → "🎭 Try demo"  
**What it does:** Links to /gcsap (GCSAP volunteer signup) instead of /login (which has demo creds right there).  

**Action:** Change link to /login, OR add a dedicated /demo page.

---

### B11. Header doesn't update for logged-in users
**Severity:** MEDIUM  
**Pages:** All pages when authed  
**What it shows:** "Login / Register Free" buttons persist in the header even after a (real) login. The "Logout" button only appears inside the dashboard.  

**Note:** Currently the demo logins don't actually authenticate, so this is somewhat moot. Once B7 is fixed, this needs handling.

**Action:** Header should conditionally render based on auth state — show user avatar/menu + Dashboard + Logout when authed; show Login + Register Free when not.

---

### B12. "Welcome to Cyber Secure Pakistan Month!" yellow banner persists for authed users
**Severity:** LOW  
**Pages:** All pages  
**What it shows:** Yellow marketing banner appears at the top of every page, including post-login.  

**Action:** Hide banner after Oct 1 (campaign start), or hide for logged-in users, or change to a dismissible cookie-based dismiss.

---

### B13. /tracks/kids metadata inconsistent with /tracks/women
**Severity:** LOW (cosmetic)  
**Pages:** /tracks/kids vs /tracks/women  
**What it shows:** Kids says "Kids 8-12, All ages welcome". Women says "Teens 13-19, Youth, Adults, All ages welcome" (4 audience tags).  

**Action:** Make all track pages consistent — every track should show the same audience-tag format (Teens / Youth / Adults / Seniors / All).

---

### B14. /forms page is empty — "No forms are currently open"
**Severity:** LOW (depends on campaign)  
**Page:** https://pisa.maahir.io/forms  
**Action:** If forms are planned but not deployed, hide /forms from footer until ready. Or seed at least one active form.

---

## ✅ WORKING (verified)

| Page / Feature | Status | Notes |
|---|---|---|
| Homepage / | ✅ | Hero, countdown, stats, 11 tracks, certificate preview, all sections render |
| /events | ✅ | 11 events, ICS export, calendar links, Reserve seat buttons |
| /scam-gallery | ✅ | 9 documented scams, submit form, defang protection |
| /first-aid | ✅ | 7 emergency scenarios |
| /partner | ✅ | 6 partner types, EOI form |
| /institutes/register | ✅ | Institute application form |
| /activity | ✅ | National Activity Wall (live counters) |
| /roleplay | ✅ | 30+ AI scam drill scenarios |
| /gcsap | ✅ | 30-day calendar, signup form |
| /media-kit | ✅ | Posters, brand assets, sample social posts |
| /report | ✅ | Problem report form with severity buttons |
| /courses/women-cyber-safety | ✅ | 3 lessons, exam, 0/3 attempts |
| /courses/be-a-cyber-hero | ✅ | 4 lessons, exam |
| /learn/.../<id> | ✅ HTTP 200 | All lesson pages load |
| /exam/.../<id> | ✅ HTTP 200 | All exam pages load |
| /leaderboard | ✅ | Tabs work, Karachi=50 XP, no defenders yet |
| /pledge | ✅ | Sign + count, dedup issue (see B8) |
| /admin | ✅ redirects to /login | Auth-protected correctly |
| /api/me/export | ✅ HTTP 401 unauth | API is auth-protected |
| /api/status | ✅ HTTP 200 | Returns correct db:true, ai:false |
| /api/pledge (POST) | ✅ | Works — count went 7→8 on test submit |
| cti.pisa.maahir.io (OpenCTI) | ✅ HTTP 200 | External lab alive |
| /dashboard (after login) | ⚠️ renders but no auth | See B5/B7 |

---

## 🔑 Test Logins (confirmed working as of today)

| Role | Email | Password | Notes |
|---|---|---|---|
| Trainee demo | demo@pisa.org.pk | Demo-Pisa-2026! | Accepts, redirects to /dashboard but NO session set |
| GCSAP Incharge demo | gcsap-demo@pisa.org.pk | Gcsap-Demo-2026! | Same — accepts, no session |
| Admin (play.maahir.io) | admin@maahir.io | Maahir@1234 | ❌ **DOES NOT work on pisa.maahir.io** — "Incorrect email or password" |

---

## 🛠️ Recommended Order of Fixes (before Oct 1 launch)

1. **B3 + B4** — Fix /status UI rendering + bring AI/MiniMax back online (1-2 hours)
2. **B1 + B2** — Build /verify (2-4 hours), fix /ctf routing (1 hour)
3. **B5 + B6 + B7** — Auth middleware + login cookie set (2-4 hours)
4. **B9** — Fix the cybercrime WA link (5 minutes)
5. **B8 + B10-B14** — Polish (1-2 hours total)

---

## 📌 Open Questions

1. **What's the real PISA admin login?** Need a valid `admin@...` or similar credential to do admin-side QA (institute approvals, certificate issuance, user management). The demo creds don't expose admin features.
2. **Where is /verify supposed to live?** Is there a separate service (certificates.pisa.maahir.io?) or should /verify be built?
3. **Is the CTF platform on a different subdomain?** cti.pisa.maahir.io works (OpenCTI). Is there a ctfd.pisa.maahir.io for CTFd that just needs a proxy?
4. **Was the dashboard intended to be public (demo state)?** Or is it broken? If intended public, the "Logout" button + "My Training/Exams/Certificates/Badges" sections are misleading.
5. **What's the campaign launch posture?** Oct 1 is 1 day away. Is the current state (Postgres shown down, AI down, /verify 404, /ctf 404, login broken) acceptable for a soft launch, or do we need it locked down before?

---

*Report generated by X2 via automated browser + curl QA. 50+ pages tested. No data was submitted beyond a single test pledge (count 7→8 confirmed).*