performance-audit

Performance Audit

Overview

A slow application is a broken application. Performance issues are bugs that cost money and users.

Core principle: Measure before optimizing. Profile before guessing.

The Iron Law

NO OPTIMIZATION WITHOUT PROFILING DATA. NO ASSUMPTION WITHOUT MEASUREMENT.

When to Use

• "Why is this slow?"
• Response times > thresholds
• High database query counts
• Memory growth over time
• CPU spikes
• Scaling concerns
• Before launching high-traffic features
• During any codebase audit

When NOT to Use

• Schema design review only (use database-audit)
• Architecture evaluation (use architecture-audit)
• Premature optimization of code that isn't slow (YAGNI — measure first)

Anti-Shortcut Rules

YOU CANNOT:
- Say "this is slow" without measuring — what's the actual latency? What's the target?
- Optimize without profiling first — you'll optimize the wrong thing
- Say "no N+1 issues" without tracing query counts per request — count queries, don't guess
- Assume caching fixes everything — stale data bugs from bad caching are worse than slowness
- Skip frontend performance because "the backend is the bottleneck" — audit both
- Ignore P99 latency because P50 looks good — users experience tail latency
- Say "it's fast enough" without defining what "fast enough" means — quantify the target
- Benchmark in development and apply conclusions to production — environments differ

Common Rationalizations (Don't Accept These)

Rationalization	Reality
"It's fast on my machine"	Your machine has one user. Production has thousands.
"We can scale by adding servers"	Horizontal scaling doesn't fix N+1 queries or memory leaks.
"The ORM handles query optimization"	ORMs generate queries. You optimize them.
"Nobody has complained about speed"	Users leave silently. They don't file bug reports.
"We'll optimize when it's a problem"	By then you've built on top of the bottleneck.
"Caching will fix it"	Caching masks problems and introduces consistency issues.
"100ms is fast enough"	For one request. At 1000 concurrent, it's 100 seconds of CPU.