Sample report — every section a FlexPick audit can produce

This page shows one repository reported at every level, so you can see exactly what each tier adds. Each section is tagged with the lowest tier that includes it — and every tier also includes everything below it.

Included from · Diagnostic Report

Included from · Deep AI Code Review

Included from · Expert Audit

Codebase Health — Developer Report

https://github.com/acme/example-saas · 2026-10-21

44 overall health, 0–100 (higher is healthier)

This codebase scores better than 38% of repositories we've audited.

+3 since your previous audit on 2026-09-17

A four-month-old AI-assisted codebase with working core flows but heavy duplication, no automated tests, and several dependency risks. Shippable today, fragile tomorrow: most incidents will come from the checkout and auth modules, where copies of the same logic have already drifted apart.

Included from · Diagnostic Report

Health scores

structure

duplication

-2

testing

+12

dependencies

security hygiene

-5

Included from · Diagnostic Report

What we found

critical committed-secret src · 3 findings

What it is: Three live-looking API keys are committed to the repository, including one in .env.production.

What it affects: src/config.ts, .env.production

What fixing it buys you: Rotating these and moving them to environment variables removes the single highest-impact risk in this codebase.

high duplicated-block src/services · 18 findings

What it is: Eighteen blocks of 30+ lines are duplicated across the payment and checkout modules, and four copies have already drifted apart.

What it affects: src/services/PaymentService.ts, src/screens/Checkout.tsx and 6 other files

What fixing it buys you: Extracting one shared price calculation means a pricing fix lands once instead of four times.

high vulnerable-dependency . · 12 findings

What it is: Twelve dependencies have known advisories, four of them rated high or critical by OSV.

What it affects: package.json

What fixing it buys you: Most resolve with a patch-level bump; upgrading closes known exploit paths without touching your own code.

medium missing-authorization src/api · 7 findings

What it is: Seven API handlers read a tenant identifier straight from the request without checking it against the session.

What it affects: src/api/handlers.ts

What fixing it buys you: A single shared guard closes the whole class of cross-tenant data access.

medium oversized-file src · 5 findings

What it is: Five files exceed 900 lines, the largest at 2,412 — and they are also the most frequently changed.

What it affects: src/services/PaymentService.ts, src/screens/Checkout.tsx and 3 other files

What fixing it buys you: Splitting the two hotspots first makes the riskiest area of the codebase reviewable again.

Included from · Diagnostic Report

Repository facts

412

source files

68,450

lines of code

26.4%

duplicated lines

2.2%

test file ratio

CI configured

potential secrets

Languages: TS 41,200 loc · TSX 15,300 loc · JS 6,900 loc · CSS 3,050 loc · JSON 2,000 loc

Largest files	Lines
src/services/PaymentService.ts	2,412
src/screens/Checkout.tsx	1,876
src/api/handlers.ts	1,544
src/state/store.ts	1,102
src/utils/helpers.ts	987

Last commit: 2026-06-28

Change hotspots (last 200 commits)	Changes	Lines
src/services/PaymentService.ts	41	2,412
src/screens/Checkout.tsx	28	1,876
src/api/handlers.ts	19	1,544

2 contributor(s) in the last 200 commits — top contributor authored 94% of them.

Included from · Diagnostic Report

Risks, ranked by impact

high No automated tests on payment-critical flows

Evidence: 0 test files across 214 source files; checkout, refund, and webhook handlers are fully untested.

Recommendation: Add a smoke suite around checkout and webhooks first — 10-15 tests catch the regressions that actually cost money.

high Checkout logic duplicated in 4 places with drift

Evidence: Price calculation appears in 4 files; two copies already disagree on coupon rounding.

Recommendation: Extract a single PriceCalculator service and delete the copies; the drift is a live billing bug waiting to be reported.

high Secrets committed to the repository

Evidence: 2 API keys and 1 database password found in tracked config files.

Recommendation: Rotate the exposed keys today, move them to environment variables, and add secret scanning to CI.

medium 37 dependencies pinned to unmaintained versions

Evidence: Lockfile references 9 packages with no release in 2+ years, including the session middleware.

Recommendation: Upgrade the framework minor version and replace the two abandoned packages with maintained forks.

medium God-file controllers

Evidence: 3 controllers exceed 800 lines and mix validation, business logic, and rendering.

Recommendation: Split by responsibility as you touch them — don't big-bang refactor; extract services per feature.

low No error monitoring

Evidence: No error-tracking SDK found; production failures are invisible unless a user reports them.

Recommendation: Wire an error tracker (Sentry or similar) — 30 minutes of work, immediate visibility.

Included from · Deep AI Code Review

Deep file review

Reviewed 34 files, selected as the riskiest in this repository.

src/services/PaymentService.ts

critical Discount is applied after tax, and only on one of the four code paths line 412

applyDiscount() runs after calculateTax() here, but before it in the three duplicated copies. The same order produces different totals depending on which path the request takes.

Fix: Extract one pricing function with an explicit order of operations, cover it with tests for the discount-plus-tax case, and delete the copies.

Effort: M

Also involves: src/screens/Checkout.tsx, src/api/handlers.ts

high Payment webhook is trusted without verifying its signature line 688

handleWebhook() parses the request body and updates order state without calling the provider's signature verification. Any caller who knows the URL can mark an order paid.

Fix: Verify the provider signature before parsing, and reject unsigned requests outright.

Effort: S

src/api/handlers.ts

high Tenant id is read from the request body rather than the session line 96

getInvoices() filters on req.body.tenantId with no check that the caller belongs to that tenant, so changing one field returns another customer's invoices.

Fix: Resolve the tenant from the authenticated session and treat any client-supplied tenant id as untrusted.

Effort: M

Also involves: src/api/handlers.ts

src/state/store.ts

medium One global store holds auth, cart, and UI state together

Every module imports the same store object, so a change to cart shape forces re-renders across unrelated screens and makes any module impossible to test in isolation.

Fix: Split the store by domain. This is the structural reason the codebase is hard to change safely, but it should follow the correctness fixes above.

Effort: L

Also involves: src/screens/Checkout.tsx

src/screens/Checkout.tsx

medium Submit button is not disabled while the charge is in flight line 233

onSubmit() awaits the charge without guarding re-entry; a double click issues two charges, and there is no idempotency key on the request.

Fix: Disable the control on submit and send an idempotency key so a retry cannot double-charge.

Effort: S

src/utils/helpers.ts

low Date helper assumes the server timezone line 148

formatDueDate() builds a Date from a bare string, so invoice due dates shift by a day for users west of UTC.

Fix: Parse and render dates in an explicit timezone rather than the host default.

Effort: S

Included from · Expert Audit

Human expert review

Reviewed by a human expert.

I have read the automated findings against the code and agree with the ranking, with one change: the unverified payment webhook is the most urgent item here, ahead of the committed secrets. The secrets are real and must be rotated, but they are scoped to a staging project; the webhook lets an unauthenticated caller mark any order as paid in production. I removed two duplication findings that flagged generated API clients, which are meant to be identical, and downgraded the god-object finding to medium: it is a genuine constraint on future work but nothing breaks because of it today. Two weeks of focused work on the first four items would move this codebase out of the risk band it is in.

Removed 2 false positives (generated clients in src/api/generated). Re-ranked the webhook finding from high to critical. Confirmed the discount-ordering bug by hand against all four duplicated code paths — it is reproducible and customer-visible.

Reviewed by Serhii Fedorenko on 24/08/2026 09:20

Included from · Diagnostic Report

What to fix first

#	Step	Why	Effort
1	Rotate the committed secrets and move them to env vars	They are exposed to anyone with repo access, today	S
2	Add smoke tests around checkout and webhooks	Highest-cost regressions with zero safety net	M
3	Extract the duplicated price calculation into one service	Two copies already disagree — this is a live billing bug	M
4	Set up CI running the new tests plus secret scanning	Locks in the gains from the first three steps	S

Scores and findings are derived from automated static analysis at generation time. Reply to your report email to discuss any finding with an engineer.