audit-codebase

Codebase Audit Checklist

Thesis: Score the codebase across 7 categories with exact file citations. Check ADRs before flagging documented design decisions.

Run this checklist for release readiness audits. Cite exact file paths and line numbers for every finding. Check docs/adr/ for ADRs before flagging documented design decisions.

Core patterns (apperror, parameterized SQL, batch(), Switch/Match, createResource, alive guard) — see codebase-standards. Frontend fetch — solidjs-data-fetching. Route UI — solidjs-pages.

Backend

• All SQL uses $N parameterized placeholders (no fmt.Sprintf with values or identifiers)
• No _ = fn() discarded errors in production code
• No echo.NewHTTPError in production code (use apperror)
• Token refresh is transactional and TOCTOU-safe (atomic UPDATE...RETURNING)
• Password reset uses SELECT...FOR UPDATE inside transaction
• Verification tokens hashed with selector/verifier pattern
• All rows.Next() loops check rows.Err() after iteration
• JWT_SECRET rejects CHANGE_ME placeholder at startup
• Production entrypoint exits on migration failure
• Timeout middleware uses Echo's built-in (no custom goroutine race)
• All operational constants in Config struct with env var overrides
• ForgotPassword/ResendVerification log errors server-side (anti-enumeration: always return 200)

Frontend

• Zero createResource — use onMount + signals (see solidjs-data-fetching)
• Zero nested <Show> for content states — use Switch/Match (see solidjs-pages)
• Zero window.confirm() — use DestructiveModal (see solidjs-pages)
• Zero onMount/createEffect cleanup returns — use onCleanup (see solidjs-data-fetching)
• Zero any in production — use unknown (e.g. Record<string, unknown>)
• Auth store reacts to auth:session-expired when token cleared
• Auth cookie Secure on HTTPS set and clear paths
• Skip link present with correct target and tabindex
• Auth guard effects use on() without defer (see solidjs-pages)
• batch() wraps signal updates after every await (see solidjs-data-fetching)