Start
Starting audit and score
A scan of the codebase in P0-P3 order and a score for critical flows.
- Payment, login, data write paths
- Critical paths without tests
Code support
I read the code the team wrote and list findings by severity; we reproduce the bug in production and find its root cause; we deliver the fix together with a test that breaks when the fix is reverted.
With code inherited from someone else, I start with the path that touches the most money and data.
- P0now
- Security, money, data loss. Must not stay live; this comes first.
- P1before release
- Wrong result. Shows the user a wrong figure or a wrong status.
- P2planned
- Fragile spot. Works today, fails at the first unexpected case.
- P3improvement
- Readability and repetition. The code works, but makes the next change harder.
06.1The work in three parts
A green test alone is not proof. A test that does not break when the fix is reverted is not catching the bug.
aWhat we do
- Code reviewI read the changes and write findings in P0-P3 order, with line numbers.
- DebuggingWe reproduce the production bug first, then find its root cause.
- TestingTests for critical flows that really catch the bug.
- TakeoverA map of undocumented code: what is where, which part touches what.
bWhat we deliver
- List of findingsEach finding: location, problem, suggested fix, test.
- Fix branchOn a separate branch, with small, explained commits; the merge decision is yours.
- TestsShown to break when the fix is reverted.
- Code mapA one-page structure note for an inherited project.
cHow we measure
- Escaped bugsNumber of bugs found after reaching production, month by month.
- Time to fixTime from a bug being reported to the fix going live.
- RepeatsHow often the same kind of bug shows up again.
- CoverageShare of paths in critical flows (payment, login, data writes) that have a test.
06.2What a review looks like
Four findings in a made-up order function. Click the number on a line or a finding on the right.
Code review
A made-up example, 19 lines
order.js4 findings
export async function orderTotal(cart, coupon) {let total = 0;for (const item of cart.items) {total += item.price * item.quantity;}if (coupon) {total = total - total * coupon.rate;}const shipping = await shippingFee(cart.address);return Math.round(total + shipping);}app.post('/api/order', async (req, res) => {const { id, coupon } = req.body;const cart = await db.query(`SELECT * FROM cart WHERE id = ${id}`);const total = await orderTotal(cart, coupon);res.json({ total });});
-
User input is added to the query
P0 lines 15-16
- Problem
- The cart id is written straight into the SQL text; a value from outside can read or delete the whole table.
- Fix
- A parameterized query; the id is converted to a number and validated.
- Test
- A request that sends an SQL fragment instead of an id should return 400; the test should break when the fix is reverted.
-
The discount rate comes from the client
P0 lines 7, 14
- Problem
- The coupon object is taken from the request as it is; send a rate of 1 and the order is free.
- Fix
- Only the coupon code is taken from the client; the rate, expiry and usage limit are checked on the server.
- Test
- An expired or fake coupon should not change the order total.
-
Money is calculated with floating-point numbers
P1 lines 4, 10
- Problem
- Prices are added as floating-point numbers and then rounded to whole units; cents get lost.
- Fix
- All amounts are kept as whole numbers of cents; rounding happens in one place, with a written rule.
- Test
- With amounts like 0.10 + 0.20, the total is correct to the cent.
-
The order fails if the shipping service errors
P2 line 9
- Problem
- If the shipping fee service does not respond, the request ends in a 500 and the user does not see why.
- Fix
- A timeout and a clear error message; an event log.
- Test
- When a mocked service returns an error, does the user get the right message.
06.3Related packages
The three packages that most often go with code support.
Security
Compliance and risk review
A review of secrets, personal data and third-party dependencies.
- Secret scan in code and logs
- Old dependencies with known vulnerabilities
Speed
AI agents built for the project
Code agents: a setup that writes on its own branch, is reviewed by a separate agent, and leaves the decision to the team.
Write where the code lives and what is broken.
Repository access can be discussed later; a short description of the bug and how long it has been happening is enough to start.