Web Application Codebase Audit

Web Application Codebase Audit

Codebase audit — systematic analysis of accumulated technical debt, architecture issues and risks. Differs from review in covering entire project, not individual PR. Result — prioritized action list, not just problem list.

What Audit Includes

1. Static Code Analysis 2. Dependencies and Vulnerabilities 3. Test Coverage 4. Build Performance 5. Architecture Patterns 6. Documentation and API Contracts

Static Analysis: TypeScript/JavaScript

# TypeScript: strict checking
npx tsc --noEmit --strict

# ESLint: quality analysis
npx eslint . --ext .ts,.tsx --format=json > eslint-report.json

# Find dead code
npx ts-prune  # unused exports
npx knip     # unused dependencies and files

# Code duplicates
npx jscpd --min-tokens 50 --reporters html src/

Dependencies Analysis

# npm audit
npm audit --json > audit-report.json

# Outdated packages
npm outdated --json

# Analyze bundle size
npx @next/bundle-analyzer
# Or
npx webpack-bundle-analyzer stats.json

# License check (GPL risks in commercial projects)
npx license-checker --summary --onlyAllow "MIT;ISC;BSD;Apache-2.0"

Test Coverage

# Jest
npx jest --coverage --coverageReporters=json-summary

# Coverage thresholds
# In jest.config.ts:
coverageThreshold: {
  global: {
    branches: 60,
    functions: 70,
    lines: 70,
    statements: 70,
  },
},

Architecture Analysis: What to Look For

// PROBLEM: God Component (component does everything)
// 500+ lines, many useEffect, direct API calls in component

// PROBLEM: Prop drilling through 4+ levels
<App user={user}>
  <Layout user={user}>
    <Sidebar user={user}>
      <UserMenu user={user} />  // better: Context or Zustand

// PROBLEM: Circular dependencies
// utils → services → utils (can cause non-obvious bugs)
npx madge --circular src/

// PROBLEM: Large files
find src -name "*.ts" -o -name "*.tsx" | xargs wc -l | sort -n | tail -20

PHP/Laravel Audit

# PHPStan: static analysis
./vendor/bin/phpstan analyse --level=5 app/

# PHP Insights
php artisan insights

# Find N+1 queries (Clockwork, Laravel Debugbar)
# config/debugbar.php: 'capture_ajax' => true

# Unused routes
php artisan route:list --format=json | python3 -c "
import json, sys
routes = json.load(sys.stdin)
print(f'Total routes: {len(routes)}')
"

Audit Report

Document structure:

# Codebase Audit MyProject — 2024-03

## Summary
- **Critical issues:** 3
- **Important issues:** 12
- **Recommendations:** 24
- **Technical debt (estimate):** 120 hours

## Critical Issues

### 1. SQL Injection in UserController.php:142
**Risk:** Entire DB leak
**Example:** `DB::raw("SELECT * FROM users WHERE name = '{$name}'")`
**Solution:** Use parameterized queries
**Priority:** Fix immediately

### 2. Secrets in Repository
**File:** .env.example contains real API keys
**Solution:** Key rotation, add to .gitignore

## Important Issues

### 1. Test Coverage: 23%
**Current:** 23% lines, 18% branches
**Goal:** 60%+ lines, 50%+ branches
**Estimate:** 40 hours

## Roadmap

| Quarter | Tasks | Hours |
|---|---|---|
| Q1 2024 | Critical + security | 30 |
| Q2 2024 | Architecture refactor | 50 |
| Q3 2024 | Tests + documentation | 40 |

Medium codebase audit (50–200 files) — 3–7 working days. Large project (500+ files) — 2–4 weeks.