Sample report — this is what every FlexPick audit looks like

Codebase Health Report

https://github.com/acme/example-saas · 2026-08-18

44 overall health, 0–100 (higher is healthier)

This codebase scores better than 38% of repositories we've audited.

A four-month-old AI-assisted codebase with working core flows but heavy duplication, no automated tests, and several dependency risks. Shippable today, fragile tomorrow: most incidents will come from the checkout and auth modules, where copies of the same logic have already drifted apart.

Health scores

structure

duplication

testing

dependencies

security hygiene

Repository facts

412

source files

68,450

lines of code

26.4%

duplicated lines

2.2%

test file ratio

CI configured

potential secrets

Languages: TS 41,200 loc · TSX 15,300 loc · JS 6,900 loc · CSS 3,050 loc · JSON 2,000 loc

Largest files	Lines
src/services/PaymentService.ts	2,412
src/screens/Checkout.tsx	1,876
src/api/handlers.ts	1,544
src/state/store.ts	1,102
src/utils/helpers.ts	987

Last commit: 2026-06-28

Change hotspots (last 200 commits)	Changes	Lines
src/services/PaymentService.ts	41	2,412
src/screens/Checkout.tsx	28	1,876
src/api/handlers.ts	19	1,544

2 contributor(s) in the last 200 commits — top contributor authored 94% of them.

Risks, ranked by impact

high No automated tests on payment-critical flows

Evidence: 0 test files across 214 source files; checkout, refund, and webhook handlers are fully untested.

Recommendation: Add a smoke suite around checkout and webhooks first — 10-15 tests catch the regressions that actually cost money.

high Checkout logic duplicated in 4 places with drift

Evidence: Price calculation appears in 4 files; two copies already disagree on coupon rounding.

Recommendation: Extract a single PriceCalculator service and delete the copies; the drift is a live billing bug waiting to be reported.

high Secrets committed to the repository

Evidence: 2 API keys and 1 database password found in tracked config files.

Recommendation: Rotate the exposed keys today, move them to environment variables, and add secret scanning to CI.

medium 37 dependencies pinned to unmaintained versions

Evidence: Lockfile references 9 packages with no release in 2+ years, including the session middleware.

Recommendation: Upgrade the framework minor version and replace the two abandoned packages with maintained forks.

medium God-file controllers

Evidence: 3 controllers exceed 800 lines and mix validation, business logic, and rendering.

Recommendation: Split by responsibility as you touch them — don't big-bang refactor; extract services per feature.

low No error monitoring

Evidence: No error-tracking SDK found; production failures are invisible unless a user reports them.

Recommendation: Wire an error tracker (Sentry or similar) — 30 minutes of work, immediate visibility.

What to fix first

#	Step	Why	Effort
1	Rotate the committed secrets and move them to env vars	They are exposed to anyone with repo access, today	S
2	Add smoke tests around checkout and webhooks	Highest-cost regressions with zero safety net	M
3	Extract the duplicated price calculation into one service	Two copies already disagree — this is a live billing bug	M
4	Set up CI running the new tests plus secret scanning	Locks in the gains from the first three steps	S

Scores and findings are derived from automated static analysis at generation time. Reply to your report email to discuss any finding with an engineer.