Full codebase audit: fix critical perf bug, security, error handling, dead code

app/auth.py

@@ -14,7 +14,13 @@ from .models import User
 
 logger = logging.getLogger(__name__)
 
-SECRET_KEY = os.environ.get("SECRET_KEY", "dev-fallback-key-change-in-production")
+_FALLBACK_KEY = "dev-fallback-key-change-in-production"
+SECRET_KEY = os.environ.get("SECRET_KEY", _FALLBACK_KEY)
+if SECRET_KEY == _FALLBACK_KEY:
+    logger.warning(
+        "SECRET_KEY env var not set — using insecure fallback. "
+        "Set SECRET_KEY to a random string in production!"
+    )
 ALGORITHM = "HS256"
 ACCESS_TOKEN_EXPIRE_MINUTES = 60 * 24 * 7  # 7 days
 COOKIE_NAME = "satellite_token"

app/detection_engine.py

@@ -3,7 +3,6 @@ Satellite Change Detection Engine v2
 High-accuracy detection with multi-channel analysis, SSIM, texture features,
 adaptive thresholding, and improved object classification.
 """
-import io
 import numpy as np
 import cv2
 from PIL import Image
@@ -409,9 +408,9 @@ def _clean_mask(mask, sensitivity=0.5, border_margin=12):
     5. Fill holes inside regions
     6. Erode-then-dilate to break thin noise bridges between separate changes
     """
+    mask = mask.copy()
     h, w = mask.shape[:2]
 
-    # 1. Remove false positives along image border (common with registration)
     if border_margin > 0:
         mask[:border_margin, :] = 0
         mask[-border_margin:, :] = 0
@@ -456,18 +455,18 @@ def _severity_from_region(region, total_pixels):
     """
     Classify change severity from area and confidence.
     Green = minor, Yellow = moderate, Red = major.
-    Used for color-coded bounding boxes and table summary.
+    Area is the primary signal; confidence acts as a small bonus.
     """
     area = region.get("area", 0)
     confidence = region.get("confidence", 0.0)
     if total_pixels <= 0:
         return "minor"
     area_ratio = area / total_pixels
-    # Combined score: larger area and higher confidence -> more severe
-    score = area_ratio * 500 + confidence * 2
-    if score < 0.5:
+    # Area-dominant score: area ratio (0-1) mapped to 0-10, confidence adds 0-0.3
+    score = area_ratio * 1000 + confidence * 0.3
+    if score < 1.0:
         return "minor"
-    if score < 1.2:
+    if score < 4.0:
         return "moderate"
     return "major"
 
@@ -506,7 +505,6 @@ def visualize_changes(img1, img2, change_mask, regions=None, total_pixels=None):
     total_px = total_pixels if total_pixels is not None else (img2.shape[0] * img2.shape[1])
 
     if regions:
-        # Scale line thickness to image size so boxes are visible at any resolution
         diag = np.sqrt(img2.shape[0]**2 + img2.shape[1]**2)
         line_thickness = max(2, int(diag / 400))
 
@@ -515,15 +513,17 @@ def visualize_changes(img1, img2, change_mask, regions=None, total_pixels=None):
             severity = r.get("severity") or _severity_from_region(r, total_px)
             color = _SEVERITY_COLORS.get(severity, (255, 255, 255))
 
-            # Semi-transparent filled rect behind the box for contrast
-            box_overlay = overlay_uint8.copy()
-            cv2.rectangle(box_overlay, (x, y), (x + w, y + h), color, cv2.FILLED)
-            cv2.addWeighted(box_overlay, 0.12, overlay_uint8, 0.88, 0, overlay_uint8)
+            # Semi-transparent fill using only the ROI (avoids full-image copy)
+            x1c = max(0, x)
+            y1c = max(0, y)
+            x2c = min(overlay_uint8.shape[1], x + w)
+            y2c = min(overlay_uint8.shape[0], y + h)
+            roi = overlay_uint8[y1c:y2c, x1c:x2c]
+            fill = np.full_like(roi, color, dtype=np.uint8)
+            cv2.addWeighted(fill, 0.12, roi, 0.88, 0, roi)
 
-            # Color-coded bounding box
             cv2.rectangle(overlay_uint8, (x, y), (x + w, y + h), color, line_thickness)
 
-            # Numbered label
             rid = r.get("id", 0)
             label = str(rid)
             font = cv2.FONT_HERSHEY_SIMPLEX
@@ -629,17 +629,6 @@ def _is_transient_object(area, w, h, features):
     return False
 
 
-# Ground-level change categories only
-GROUND_CHANGE_TYPES = [
-    "New Construction/Building",
-    "Demolition/Clearing",
-    "Vegetation Change",
-    "Water Body Change",
-    "Road/Pavement Change",
-    "Bare Land/Soil Change",
-]
-
-
 def classify_object_type(image_region, bbox):
     """
     Classify GROUND-LEVEL structural changes only.
@@ -800,7 +789,7 @@ def classify_object_type(image_region, bbox):
     return best, min(conf, 1.0)
 
 
-def classify_with_ensemble(image_region, bbox, num_sub=4):
+def classify_with_ensemble(image_region, bbox):
     """Ensemble: classify full region + sub-regions, vote with confidence weighting."""
     x, y, w, h = bbox
     sub_boxes = [(x, y, w, h)]  # full region

app/main.py

@@ -25,9 +25,11 @@ from .auth import (
 )
 from .database import Base, engine, get_db, DATA_DIR
 from .models import User, DetectionRun
-# detection_engine (cv2, sklearn) imported lazily in /api/detect to speed up startup on HF Spaces
 from .notifier import send_notification
 
+import logging
+logger = logging.getLogger(__name__)
+
 # Create tables and run migrations without crashing the app (HF Spaces can restart if startup fails)
 try:
     Base.metadata.create_all(bind=engine, checkfirst=True)
@@ -124,8 +126,8 @@ def register(data: UserCreate, db: Session = Depends(get_db)):
     except HTTPException:
         raise
     except Exception as e:
-        print(f"[REGISTER] Error: {type(e).__name__}: {e}")
-        raise HTTPException(status_code=500, detail=f"Registration failed: {type(e).__name__}: {e}")
+        logger.exception("Registration failed")
+        raise HTTPException(status_code=500, detail=f"Registration failed: {type(e).__name__}")
 
 
 @app.post("/api/auth/login")
@@ -139,8 +141,8 @@ def login(data: UserLogin, db: Session = Depends(get_db)):
     except HTTPException:
         raise
     except Exception as e:
-        print(f"[LOGIN] Error: {type(e).__name__}: {e}")
-        raise HTTPException(status_code=500, detail=f"Login failed: {type(e).__name__}: {e}")
+        logger.exception("Login failed")
+        raise HTTPException(status_code=500, detail=f"Login failed: {type(e).__name__}")
 
 
 @app.post("/api/auth/logout")
@@ -234,25 +236,34 @@ async def detect(
         overlay_path.parent.mkdir(parents=True, exist_ok=True)
     except Exception:
         pass
-    Image.fromarray(result_image).save(overlay_path)
+    try:
+        Image.fromarray(result_image).save(overlay_path)
+    except Exception as exc:
+        logger.error("Failed to save overlay: %s", exc)
+        raise HTTPException(status_code=500, detail="Could not save result image")
     relative_overlay = f"overlays/{overlay_filename}"
 
     # Save full-resolution before image (used by the before/after slider from history)
-    before_full_file = OVERLAYS_DIR / f"{base_name}_before.png"
-    before_pil.save(before_full_file)
-    relative_before_full = f"overlays/{base_name}_before.png"
-
-    # Save small thumbnails for the history table rows
-    before_thumb_file = OVERLAYS_DIR / f"{base_name}_before_thumb.png"
-    after_thumb_file = OVERLAYS_DIR / f"{base_name}_after_thumb.png"
-    before_thumb_pil = before_pil.copy()
-    before_thumb_pil.thumbnail((THUMB_MAX_SIZE, THUMB_MAX_SIZE), Image.Resampling.LANCZOS)
-    before_thumb_pil.save(before_thumb_file)
-    after_thumb_pil = after_pil.copy()
-    after_thumb_pil.thumbnail((THUMB_MAX_SIZE, THUMB_MAX_SIZE), Image.Resampling.LANCZOS)
-    after_thumb_pil.save(after_thumb_file)
-    relative_before_thumb = f"overlays/{base_name}_before_thumb.png"
-    relative_after_thumb = f"overlays/{base_name}_after_thumb.png"
+    relative_before_full = ""
+    relative_before_thumb = ""
+    relative_after_thumb = ""
+    try:
+        before_full_file = OVERLAYS_DIR / f"{base_name}_before.png"
+        before_pil.save(before_full_file)
+        relative_before_full = f"overlays/{base_name}_before.png"
+
+        before_thumb_file = OVERLAYS_DIR / f"{base_name}_before_thumb.png"
+        after_thumb_file = OVERLAYS_DIR / f"{base_name}_after_thumb.png"
+        before_thumb_pil = before_pil.copy()
+        before_thumb_pil.thumbnail((THUMB_MAX_SIZE, THUMB_MAX_SIZE), Image.Resampling.LANCZOS)
+        before_thumb_pil.save(before_thumb_file)
+        after_thumb_pil = after_pil.copy()
+        after_thumb_pil.thumbnail((THUMB_MAX_SIZE, THUMB_MAX_SIZE), Image.Resampling.LANCZOS)
+        after_thumb_pil.save(after_thumb_file)
+        relative_before_thumb = f"overlays/{base_name}_before_thumb.png"
+        relative_after_thumb = f"overlays/{base_name}_after_thumb.png"
+    except Exception as exc:
+        logger.warning("Failed to save thumbnails: %s", exc)
 
     regions_serializable = [
         {
@@ -294,11 +305,8 @@ async def detect(
     db.add(run)
     db.commit()
     db.refresh(run)
-    # Base64 overlay for immediate display
-    buf = io.BytesIO()
-    Image.fromarray(result_image).save(buf, format="PNG")
-    buf.seek(0)
-    overlay_b64 = base64.b64encode(buf.read()).decode("utf-8")
+    # Read already-saved overlay for base64 (avoids re-encoding the numpy array)
+    overlay_b64 = base64.b64encode(overlay_path.read_bytes()).decode("utf-8")
 
     # Send email notification if requested
     notification_sent = False
@@ -393,7 +401,10 @@ def get_run(
     run = db.query(DetectionRun).filter(DetectionRun.id == run_id, DetectionRun.user_id == user.id).first()
     if not run:
         raise HTTPException(status_code=404, detail="Run not found")
-    regions = json.loads(run.regions_json) if run.regions_json else []
+    try:
+        regions = json.loads(run.regions_json) if run.regions_json else []
+    except (json.JSONDecodeError, TypeError):
+        regions = []
     return {
         "id": run.id,
         "title": run.title,

app/models.py

@@ -1,10 +1,14 @@
-from datetime import datetime
+from datetime import datetime, timezone
 from sqlalchemy import Column, Integer, String, DateTime, Text, ForeignKey, Float
 from sqlalchemy.orm import relationship
 
 from .database import Base
 
 
+def _utcnow():
+    return datetime.now(timezone.utc)
+
+
 class User(Base):
     __tablename__ = "users"
 
@@ -12,7 +16,7 @@ class User(Base):
     email = Column(String(255), unique=True, index=True, nullable=False)
     hashed_password = Column(String(255), nullable=False)
     full_name = Column(String(255), default="")
-    created_at = Column(DateTime, default=datetime.utcnow)
+    created_at = Column(DateTime, default=_utcnow)
 
     detections = relationship("DetectionRun", back_populates="user", order_by="desc(DetectionRun.created_at)")
 
@@ -34,7 +38,7 @@ class DetectionRun(Base):
     after_thumb_path = Column(String(512), default="")
     zone = Column(String(128), default="")
     village = Column(String(128), default="")
-    regions_json = Column(Text, default="[]")  # JSON list of regions
-    created_at = Column(DateTime, default=datetime.utcnow)
+    regions_json = Column(Text, default="[]")
+    created_at = Column(DateTime, default=_utcnow)
 
     user = relationship("User", back_populates="detections")

app/notifier.py

@@ -5,6 +5,7 @@ Credentials are read from environment variables — never hardcoded.
 """
 import logging
 import os
+import re
 import smtplib
 import ssl
 from datetime import datetime, timezone
@@ -16,7 +17,7 @@ logger = logging.getLogger(__name__)
 
 SMTP_HOST = os.environ.get("SMTP_HOST", "smtp.gmail.com")
 SMTP_PORT = int(os.environ.get("SMTP_PORT", "465"))
-SMTP_USER = os.environ.get("SMTP_USER", "vedangofficeserver@gmail.com")
+SMTP_USER = os.environ.get("SMTP_USER", "")
 SMTP_PASS = os.environ.get("SMTP_PASS", "")
 
 TEMPLATE_PATH = Path(__file__).resolve().parent.parent / "templates" / "ChangeDetection.html"
@@ -86,7 +87,6 @@ def build_email_body(
     if regions:
         html = html.replace("{{#regions}}", "").replace("{{/regions}}", "")
     else:
-        import re
         html = re.sub(r"\{\{#regions\}\}.*?\{\{/regions\}\}", "", html, flags=re.DOTALL)
 
     return html
@@ -107,8 +107,8 @@ def send_notification(
     Send detection report email to the recipient.
     Returns True on success, False on failure (never raises).
     """
-    if not SMTP_PASS:
-        logger.warning("SMTP_PASS not set — skipping email notification")
+    if not SMTP_PASS or not SMTP_USER:
+        logger.warning("SMTP_USER or SMTP_PASS not set — skipping email notification")
         return False
 
     html_body = build_email_body(

requirements.txt

@@ -1,9 +1,7 @@
 fastapi>=0.104.0
 uvicorn[standard]>=0.24.0
-gunicorn>=21.2.0
 python-multipart>=0.0.6
 sqlalchemy>=2.0.0
-psycopg2-binary>=2.9.9
 python-jose[cryptography]>=3.3.0
 passlib[bcrypt]>=1.7.4
 bcrypt==4.0.1
@@ -11,4 +9,3 @@ pillow>=10.0.0
 numpy>=1.24.0
 opencv-python-headless>=4.8.0
 scikit-learn>=1.3.0
-scipy>=1.11.0

static/js/app.js

@@ -358,9 +358,10 @@ document.getElementById('form-detect')?.addEventListener('submit', async (e) =>
 
 // ---- Show result ----
 function readFileAsDataURL(file) {
-  return new Promise((resolve) => {
+  return new Promise((resolve, reject) => {
     const reader = new FileReader();
     reader.onload = () => resolve(reader.result);
+    reader.onerror = () => reject(reader.error);
     reader.readAsDataURL(file);
   });
 }
@@ -386,11 +387,15 @@ function showResult(data) {
 
   const locParts = [data.village, data.zone].filter(Boolean);
   const locLabel = locParts.length ? locParts.join(', ') : '—';
+  const stats = data.statistics || {};
+  const pct = (stats.changePercentage ?? 0).toFixed(2);
+  const chPx = stats.changedPixels ?? 0;
+  const totPx = stats.totalPixels ?? 0;
 
   statsEl.innerHTML = `
-    <div class="stat-box"><div class="value">${data.statistics.changePercentage.toFixed(2)}%</div><div class="label">Changed</div></div>
-    <div class="stat-box"><div class="value" title="${data.statistics.changedPixels.toLocaleString()}">${formatCompact(data.statistics.changedPixels)}</div><div class="label">Changed px</div></div>
-    <div class="stat-box"><div class="value" title="${data.statistics.totalPixels.toLocaleString()}">${formatCompact(data.statistics.totalPixels)}</div><div class="label">Total px</div></div>
+    <div class="stat-box"><div class="value">${pct}%</div><div class="label">Changed</div></div>
+    <div class="stat-box"><div class="value" title="${chPx.toLocaleString()}">${formatCompact(chPx)}</div><div class="label">Changed px</div></div>
+    <div class="stat-box"><div class="value" title="${totPx.toLocaleString()}">${formatCompact(totPx)}</div><div class="label">Total px</div></div>
     <div class="stat-box"><div class="value">${(data.regions || []).length}</div><div class="label">Regions</div></div>
     <div class="stat-box stat-box-wide"><div class="value value-sm" title="${locLabel}">${locLabel}</div><div class="label">Location</div></div>
   `;
@@ -620,7 +625,7 @@ async function loadHistory() {
         <td class="thumb-cell">${afterThumb}</td>
         <td class="thumb-cell">${resultThumb}</td>
         <td class="stats-cell">${r.regionsCount} regions</td>
-        <td class="stats-cell">${r.changePercentage.toFixed(2)}%</td>
+        <td class="stats-cell">${(r.changePercentage ?? 0).toFixed(2)}%</td>
         <td class="actions-cell">
           <button type="button" class="btn btn-secondary btn-sm" onclick="event.stopPropagation(); openRunFromHistory(${r.id})">View</button>
           <button type="button" class="btn-icon" title="Delete" onclick="event.stopPropagation(); confirmDelete(${r.id})">

templates/index.html

@@ -345,6 +345,6 @@
     </div>
   </div>
 
-  <script src="/static/js/app.js?v=19"></script>
+  <script src="/static/js/app.js?v=20"></script>
 </body>
 </html>