Showing 9 of 9 findings
| AREA | FINDING | SEVERITY | RECOMMENDATION | VERDICT |
|---|---|---|---|---|
| Authentication | Session tokens never expire; password reset can be replayed. | CRITICAL | Replace with a managed provider. Week 1. | Replace |
| Deployment | Production is deployed from a laptop; no rollback path exists. | CRITICAL | Replace with CI, staging and a rollback. Week 2. | Replace |
| Data model | Schema is sound; naming is inconsistent and undocumented. | MEDIUM | Keep. Document and rename in place. | Keep |
| AI-generated code | Payment logic was generated and never reviewed; no tests. | HIGH | Senior review, then tests before any change. | Remediate |
| Performance | Booking list loads all records before rendering. | HIGH | Keep the screen. Paginate the query. | Remediate |
| Background jobs | Failed email jobs retry forever and hold up the queue. | HIGH | Add a retry limit and a dead-letter queue. | Remediate |
| Error logging | Errors go to the console and are lost on every restart. | MEDIUM | Replace with hosted error monitoring. Week 1. | Replace |
| Test coverage | Only the sign-up flow has automated tests. | MEDIUM | Add tests around payments and bookings first. | Remediate |
| Admin panel | Built on an unmaintained UI kit. It works, but changes are slow. | MEDIUM | Leave it until day 60. Replace only if the roadmap needs it. | Defer |
Keep (1)
Sound. Leave it and document it.
- Data modelMEDIUM
Keep. Document and rename in place.
Remediate (4)
Fix in place.
- AI-generated codeHIGH
Senior review, then tests before any change.
- PerformanceHIGH
Keep the screen. Paginate the query.
- Background jobsHIGH
Add a retry limit and a dead-letter queue.
- Test coverageMEDIUM
Add tests around payments and bookings first.
Replace (3)
Rebuild this part.
- AuthenticationCRITICAL
Replace with a managed provider. Week 1.
- DeploymentCRITICAL
Replace with CI, staging and a rollback. Week 2.
- Error loggingMEDIUM
Replace with hosted error monitoring. Week 1.
Defer (1)
Not now. Revisit later.
- Admin panelMEDIUM
Leave it until day 60. Replace only if the roadmap needs it.
30 / 60 / 90-DAY PLAN
Stop the bleeding: auth replaced, deployment pipeline in place, error monitoring on, backups verified.
Stabilize: payment path reviewed and tested, booking list paginated, documentation written for the kept schema.
Modernize with intent: the roadmap for what to rebuild, in what order, and what it buys the business.
We do not quote a rescue before senior review, and we do not promise every product can be repaired.