Production-readiness scan · 2026-07-09

jazzwedz/team-repo

27/100

Needs major work before production.

Fix first

critical

Zero automated tests on a 30+ route API surface

Test files: 0 per repo metadata. CI in .github/workflows/ci.yml only runs lint/typecheck/build — there is nothing to catch regressions in YAML parsing, lock refresh, blast-radius BFS, or Confluence pull-smart patch logic before customers hit them.

critical

5 known CVEs in shipped dependencies

OSV scan flags js-yaml@4.1.1 (GHSA-h67p-54hq-rp68) and mermaid@11.13.0 (GHSA-6m6c-36f7-fhxh, GHSA-87f9-hvmw-gh4p, GHSA-ghcm-xqfw-q4vr, plus one more) — mermaid is rendered server-side in api/diagrams/*, exposing users to prototype pollution / ReDoS.

high

Single shared SITE_PASSWORD is the entire auth model

.env.local.example documents SITE_PASSWORD as the sole gate; api/auth/login/route.ts confirms it. Any paying customer means shared credential, no audit attribution, no rotation, no MFA — and src/app/admin/* is reachable by anyone with the password.

Nine dimensions

DevOps
32
CI runs lint/typecheck/build and Dockerfile uses non-root user, but no deploy pipeline, no test stage, no staging env.
Security
14
Capped by vulnerable deps (js-yaml 4.1.1, mermaid 11.13.0 with 5 CVEs) and SITE_PASSWORD single-string auth in .env.local.example.
Cost & infra
42
MIT license and single container keep infra cheap, but unbounded Anthropic API calls with no rate/cost guardrails per user.
QA & testing
6
Explicit zero test files despite 30+ API routes and complex business logic; CI has no test stage to fail.
Performance
20
No caching, no profiling, no load tests; LLM and Confluence calls hit on every request without batching or memoization visible.
Architecture
30
Filesystem locks and _history/ suggest versioning, but no backups, no DB migrations, and storage is just YAML in Git.
Code quality
30
TypeScript strict + ESLint configured, but no tests and AI-vibe-coded sprawl across 100+ files in src/lib and src/app/api.
Observability
22
src/lib/log/ has sinks/redaction but no error tracking (Sentry/equivalent) for a public web_app with AI calls.
Maintainability
48
LICENSE MIT, CHANGELOG, SECURITY.md, docs/ present; but 0 stars, single contributor, and zero adoption signals.

Top findings (AI)

critical

Zero automated tests on a 30+ route API surface

Test files: 0 per repo metadata. CI in .github/workflows/ci.yml only runs lint/typecheck/build — there is nothing to catch regressions in YAML parsing, lock refresh, blast-radius BFS, or Confluence pull-smart patch logic before customers hit them.

critical

5 known CVEs in shipped dependencies

OSV scan flags js-yaml@4.1.1 (GHSA-h67p-54hq-rp68) and mermaid@11.13.0 (GHSA-6m6c-36f7-fhxh, GHSA-87f9-hvmw-gh4p, GHSA-ghcm-xqfw-q4vr, plus one more) — mermaid is rendered server-side in api/diagrams/*, exposing users to prototype pollution / ReDoS.

high

Single shared SITE_PASSWORD is the entire auth model

.env.local.example documents SITE_PASSWORD as the sole gate; api/auth/login/route.ts confirms it. Any paying customer means shared credential, no audit attribution, no rotation, no MFA — and src/app/admin/* is reachable by anyone with the password.

high

No error tracking in production

Error tracking: false per repo metadata. A web_app exposing LLM, Confluence, Git and mermaid endpoints with no Sentry/Datadog/equivalent means silent failures and no alerting when an Anthropic rate limit or GitHub 401 hits.

medium

No backups or migration strategy for stored catalog

Catalog lives as YAML in a Git repo (GIT_PROVIDER=github|ado|filesystem), but there is no documented backup cadence, no export-as-of-date flow for tenants, and the filesystem provider has zero durability story if the volume is ephemeral.

medium

Unbounded LLM cost exposure

src/lib/llm/anthropic.ts and with-logging.ts call Claude Sonnet 4 from agents/coach/propose, solutions/enrich, generate, and admin/llm-calls/export with no visible per-user or per-tenant budget cap — one runaway tenant can drain a small team's runway.

Report sections

Open a section for the evidence that drove the score. If you open one first, start with Dependencies.

01Security Secrets and committed configuration checks 02Dependencies 2 vulnerable runtime package(s) 03Code 0 measured code-quality finding(s) 04Deploy 0 deploy-readiness finding(s) 05Tests & CI Test and CI signals that prove the code before merge 06Infrastructure Run the Railway audit to measure what is live

What this scan inspected

This scan predates coverage reporting, so what it inspected was not recorded. Re-scan the repository for a report that states its own coverage.

Every section above links to the evidence behind it. Nothing on this page is asserted without a source.

Scan your own repo

Free scan. No signup.

Run free scan