map-routing-geo-review

Check that Google Maps keys are restricted by HTTP referrer and limited to only the APIs used, and that Mapbox tokens have minimum scopes like styles:read and tiles:read. Any key visible in a browser URL query string must be referrer-restricted, and backend geocoding calls must use server-side environment variables.

Rendering more than 200 markers as individual DOM elements causes severe frame-rate drops, so clustering with Leaflet.markercluster or Supercluster is required. Above 5,000 points, switch to canvas rendering such as CircleMarker on a canvas layer or Mapbox circle layers with a GeoJSON source.

The most common cause is mixing coordinate order: Leaflet uses [lat, lng] while GeoJSON uses [lng, lat] with longitude first. Audit every coordinate array in the codebase and validate latitude stays within -90 to +90 and longitude within -180 to +180.

Yes, location data must not be sent to analytics or third parties without explicit user consent under GDPR and CCPA. navigator.geolocation should never be called silently on page load, and stored trip history requires a retention policy and user deletion support.

GeoJSON works well under 2 MB or 5,000 features with instant loading, but degrades beyond 20 MB and risks browser crashes past 100,000 features. Larger datasets or zoom-dependent rendering need vector tiles generated with tippecanoe or Planetiler, served via PMTiles or a tile server like Martin.

It does not cover pure database GIS query review such as PostGIS with no front-end map, which belongs to a backend review. It also excludes geospatial ETL pipelines processing Shapefiles or GeoTIFFs without any map rendering component.