Customer assessment report

Nokio platform assessment

A consolidated review of the product as it exists today: nine sibling repositories, a live Express API, Next.js web, React Native mobile, and production UX on nokioapp.com. Prepared so engineering and product stakeholders can agree on what ships, what is unfinished, and what to do first.

Workspace review 3–4 September 2026 · Static code analysis of all repos · Playwright against https://nokioapp.com (signed-out, signed-in, device agents, 7 viewports) · Not a penetration test and not a load test.

~5 / 10Workspace maintainability

2.6 / 5Signed-in web UX (mean)

3Critical security findings

22Capabilities mobile-only vs web

What Nokio is A closed-network “what should I watch?” product. Ratings and recommendations come from people the user already trusts — not an AI catalog and not a streaming player. After a decision, the user watches on a theatre or a streaming service. Two user types exist: general users (private circles) and public-profile users (followable critics).

How to read this report

1. Codebase structure Nine GitLab repos, quality scores, two eras of code, and where risk concentrates. 2. Technical architecture Runtime map, request path, interactive schema (click a table), and API request/response samples. 3. User journeys Web browse-first vs mobile account-first, core loop, and web/mobile parity gaps. 4. Design analysis Scores, all production screenshots (pages, 7 device agents, 7 viewports, 33-frame session), and the device-wise gap report. 5. Recommendations One sequenced plan: security, then UX truth, then architecture, then parity. Appendix — Schema Click a model for columns, keys, validations, and stored procedures. Appendix — API 24 endpoints with request and response JSON samples.

Executive findings

The live product is real and used. Discovery catalogs, movie pages, festivals, and public-profile follow all work. The engineering and product story is uneven: newer islands (web React Query + OpenAPI models, backend routes/web DTOs, IMDb Lambda pipeline) sit next to fat Express files, stub repos, and a web app that still presents a public catalog after login.

Engineering

One Express process is the system of record. Web and mobile are clients against /api. Three named services — data-services, recommendation-services, devops — are empty. The Nest batch app is a scaffold. Highest-quality density is the IMDb preprocess pipeline; highest operational risk is the backend (size, auth, secrets, almost no tests).

Product

Mobile is the full social product (notifications, groups, chat, stories, public-profile creation, push). Web is a strong discovery and movie page plus a thinner signed-in graph. FAQ copy promises friends on home; production home after login is still trailers and new releases. Search without a query is an empty page.

Design / responsive

Phone layouts are cramped but mostly intentional. The broken band is tablet (about 480–919px): JS still shows desktop nav, CSS has not stacked home columns, search truncates, hamburger remains. Header tap targets are 16px tall. JS and CSS disagree on every breakpoint; first paint on phone assumes a 1600px desktop width.

Security (P0)

Credentials are tracked in git (backend env file, mobile APNs signing key). Password hashing uses PBKDF2 with a single SHA-1 iteration. JWT identity is taken from the token payload without reloading the user from MySQL. These should be treated as production incidents before feature work.

Scores at a glance

Surface	Score	Read as
aws / imdb_json	7 / 10	Best-engineered piece in the workspace
web-app	6 / 10	Cleanest client; silent errors and auth-header drift
mobile-app-new	5.5 / 10	Shippable; mid-migration; APNs key in git
backend	4.5 / 10	Hub of the system and the most debt
data-ingestion	4 / 10	Working ops scripts, not a package
nokio-batch-job-app	2 / 10	Nest Hello World only
data-services, recommendation-services, devops	0 / 10	Empty stubs
Web UX, signed-out (24 routes)	2.5 / 5	Catalogs work; social/account shells do not
Web UX, signed-in (22 routes)	2.6 / 5	Unlocks profile and write-review; not a social home

What we verified on the live site

A signed-in session on production completed: trailer playback, watchlist add (0 → 1), search with a query, follow (1 → 4 followings), public profile open, platform settings. Review submit stayed disabled — star rating ignores a click that has no prior pointer-move. Clicking a trailer thumbnail applied a platform filter instead of playing. Empty /movies still shows no field and no results.

Scope limits No production traffic metrics, no penetration test, no full CVE scan, no iOS/Android store-build review. Security findings are from static inspection of tracked files and auth code. UX scores are job-completion scores from Playwright, not visual-design scores alone.