code-quality-audit

Run a comprehensive code quality audit of this codebase.

Audit areas

Investigate each area systematically. Search broadly before drawing conclusions — read files, grep for patterns, and check multiple directories.

Look for common security issues:

Hardcoded secrets: search for password=, api_key=, secret=, token= followed by a literal string value in non-test, non-example files
SQL injection vectors: string concatenation or f-strings/template literals that embed variables directly into SQL query strings
XSS: direct innerHTML assignment in JavaScript or TypeScript files without sanitization
Insecure defaults: DEBUG=True, CORS allow *, verify=False in requests calls, NODE_ENV not set to production in deployment config

Look for patterns that commonly cause performance problems:

N+1 query patterns: a database call inside a loop
Synchronous operations that could be async: blocking I/O in a path that handles concurrent requests
Large files read entirely into memory: fs.readFileSync, open().read() on files that are not guaranteed to be small

Functions over 50 lines: read source files and estimate function lengths
Files over 300 lines: use find . -name "*.py" -o -name "*.ts" -o -name "*.js" | xargs wc -l | sort -rn | head -20 (exclude node_modules, dist, .git)
Deeply nested conditionals: more than 4 levels of if/for/while nesting
Magic numbers: numeric literals used directly in conditions without a named constant

Read package.json, requirements.txt, or go.mod. Note:

Packages listed as deprecated in their README or comments in the file
Packages with obvious CVE mentions in README or lock file comments
Packages pinned to very old major versions (e.g., a major version more than 2 behind current)

Return a structured report with these sections:

Executive summary — three bullet points covering the most important findings across all areas.

Findings by area — for each area (Security, Performance, Maintainability, Dependencies):

Each finding must include a specific file:line reference. Do not list findings without a location.

Top 3 recommended fixes — the three findings that would have the greatest positive impact, in priority order, with a brief rationale for each.

If an audit area has no findings, state “No issues found” for that area rather than omitting it.