Sample Code Audit Report
This is what an actual audit deliverable looks like: letter-graded, evidence-backed, with file:line citations and ground-truth scanner output, not a slide deck of generic advice. Client name, repo paths, and identifying details below have been anonymized; the format and rigor are unchanged.
Client: [Redacted, Series A SaaS platform]
Date / Commit / Scope: 2026-07 · main@a4f9e21 · full stack (API, web frontend, infra)
Ground-truth checks run: secrets scan (full git history), dependency vulnerability audit, static analysis, type health, license compliance
Grading standard: grades are set against enterprise / regulated-industry expectations (what a SOC 2 audit or an enterprise security questionnaire would apply), not "good for an early-stage startup." A well-built system with one open door is still a system with an open door.
How to read this document:
- Critical / High / Medium / Low: severity, see rubric in the full report.
- Confirmed means I opened the file and verified it myself. Reported means it's a pattern match or secondhand claim pending verification.
- Every citation below is
file:line, so it's spot-checkable without reopening the codebase.
1. Executive Summary
Plain-English: the product is stable and the architecture is sound, but two authentication gaps would fail an enterprise security review today, and the test suite doesn't cover the code paths that would actually catch a regression before a customer does. None of it is a rewrite; most of it is a focused two-week sprint.
Top 5 findings
| # | Finding | Severity | Confidence | Section |
|---|---|---|---|---|
| 1 | No CSRF protection on state-changing API routes | Critical | Confirmed | §2 Security |
| 2 | JWT stored in localStorage instead of an httpOnly cookie | High | Confirmed | §2 Security |
| 3 | N+1 query on the dashboard's primary list endpoint | High | Confirmed | §3 Scalability |
| 4 | CI test job configured with continue-on-error, never actually blocks a merge | High | Confirmed | §4 Testing & CI |
| 5 | Three components over 400 lines mixing data fetching, state, and view logic | Medium | Confirmed | §5 Code Quality |
2. Security
D+Plain-English: auth itself (login, session issuance) is solid, but two gaps around it, CSRF and token storage, are the kind an enterprise security questionnaire flags automatically.
Ground truth (secrets scan, full git history):
0 leaks found across 1,842 commits
Ground truth (dependency vulnerability audit):
2 moderate, 1 high severity vulnerability (4 total dependencies audited)
-
Critical · Confirmed ·
src/api/middleware/session.ts:88router.post('/billing/update-plan', requireAuth, updatePlan)No CSRF token check on this or any other state-changing route. An authenticated user's session can be driven from a third-party page.
-
High · Confirmed ·
src/lib/auth-client.ts:24localStorage.setItem('jwt', response.token)Access token is readable by any script on the page, including a compromised dependency. Should move to an httpOnly, SameSite cookie.
Top 3: CSRF gap, token storage, insufficient input validation on the same route group.
3. Scalability & Performance
B-Plain-English: the app holds up fine at current load. The one query pattern below is the thing that will page someone at 3x current traffic, not before.
-
High · Confirmed ·
src/api/dashboard/projects.ts:51projects.map(p => await db.tasks.findMany({ where: { projectId: p.id } }))N+1 query on the dashboard's primary list view: one round-trip per project instead of a single joined query. Fine at 20 projects per account, measurable lag past 200.
Top 3: N+1 on the dashboard list, no index on tasks.project_id, missing memoization on the reporting chart's recompute.
4. Code Quality & Maintainability
BGround truth (type health check):
0 errors, 1,204 files checked
-
Medium · Confirmed ·
src/components/UserDashboard.tsx:1-438438-line component mixing data fetching, derived state, and view logic. Not broken, but every change to this file risks touching three unrelated concerns at once.
Top 3: oversized dashboard component, inconsistent error-boundary coverage, two duplicated date-formatting helpers.
5. Testing & CI
C-Plain-English: there is a real test suite, but it's not actually gating deploys. That's worse than having no CI at all, because it looks safe on the dashboard while doing nothing.
-
High · Confirmed ·
.github/workflows/deploy.yml:34- run: npm test continue-on-error: true
A failing test suite still deploys. 65% coverage exists on paper but enforces nothing.
Top 3: non-blocking test job, no coverage on the billing webhook handler, no test for the CSRF gap above.
6. Scorecard
| Section | Grade | Rationale |
|---|---|---|
| Security | D+ | CSRF gap on state-changing routes is a hard disqualifier at enterprise bar. |
| Scalability & Performance | B- | One real N+1 pattern; everything else holds at current scale. |
| Code Quality & Maintainability | B | Clean type health (0 type errors), a handful of oversized components. |
| Testing & CI | C- | Coverage exists but CI doesn't enforce it (continue-on-error). |
7. Prioritized Remediation Plan
P0, launch-blocking
- 1. Add CSRF tokens to all state-changing routes (Effort: M, Refs: §2)
- 2. Move the JWT from localStorage to an httpOnly, SameSite cookie (Effort: M, Refs: §2)
P1, first hardening sprint
- 3. Remove
continue-on-errorfrom the test job so CI actually gates deploys (Effort: S, Refs: §5) - 4. Replace the per-project loop with a single joined query on the dashboard list endpoint (Effort: S, Refs: §3)
P2, backlog
- 5. Split the 438-line dashboard component into data/state/view layers (Effort: L, Refs: §4)
- 6. Add coverage for the billing webhook handler (Effort: M, Refs: §5)
8. Glossary
- CSRF (Cross-Site Request Forgery): an attack that tricks a logged-in user's browser into submitting a request they didn't intend, using their existing session.
- N+1 query: a pattern where an app makes one database round-trip per item in a list instead of one query for the whole list, slow at scale even though each individual query is fast.
- httpOnly cookie: a cookie that JavaScript on the page can't read, protecting it from theft via a compromised script or dependency.
Get Your Full Code Audit
Ready for a comprehensive analysis like this? Get detailed recommendations and actionable improvements for your codebase.
Order Your Audit
Try the Free Audit
Apply for one of 10 free code audits. Limited spots available for qualifying projects.
Apply for Free Audit An audit finds the problems. If you need someone steering the technical decisions ongoing, see if a fractional CTO makes sense for your stage.