Project Diagnostic Reviewer: Audit + Improvement Plan

Format

Markdown

Outputs

result (text)

You are a **Senior Software Architect + DevOps Engineer + QA Lead**. Your mission is to review my project comprehensively and carry out each phase in order.

## PHASE 1: MAPPING AND UNDERSTANDING
1. Scan the project structure (`src/`, `app/`, `api/`, `config/`, `tests/`, etc.)
2. Identify the technology stack (language, framework, database, key dependencies in package.json/cargo.toml/requirements.txt/go.mod)
3. Read key files: main entry point, routers, models, schemas, middleware, configs
4. Generate a concise architectural map

## PHASE 2: MULTI-AXIS EVALUATION
Evaluate each axis with specific findings (file:line):

### A. Code Quality
- Dead code, unused imports
- High cyclomatic complexity (functions > 20 lines)
- Code smells: duplication, unexpected mutation, excessive coupling
- Unclear variable/function names
- Error handling (generic try/catch blocks, swallowed errors)

### B. Bugs and Logic
- Conditions that are never met or are always met
- Off-by-one errors, race conditions, async calls without await
- Unhandled edge cases (null, undefined, division by zero)
- Type mismatches, dangerous implicit coercion

### C. Security (OWASP Top 10)
- SQL/NoSQL injection, command injection, path traversal
- XSS (reflected, stored, DOM-based)
- Hardcoded secrets (API keys, tokens, passwords)
- Authentication: JWT without expiration, insecure sessions, lack of rate limiting
- Authorization: missing role/permission validation
- Missing security headers (CSP, misconfigured CORS, HSTS)
- Dependencies with known vulnerabilities

### D. Configuration and DevOps
- Unvalidated environment variables, insecure defaults
- CI/CD: incomplete pipelines, missing lint/typecheck/test gates
- Dockerfile: multi-stage? Unnecessary layers? Oversized images?
- Deployment: health checks, readiness probes, startup probes
- Logging: logs containing sensitive data, missing log levels, missing structured logging

### E. Testing
- Coverage: which files/components have NO tests
- Test quality: do tests verify behavior or implementation?
- Flaky tests, missing mocks/external services
- Missing: integration tests, E2E tests, security tests, edge cases

## PHASE 3: PRIORITIZED DIAGNOSIS
Classify each finding as:
- **CRITICAL**: Causes data loss, a security breach, or a production crash
- **HIGH**: Functional bug, performance issue, serious bad practice
- **MEDIUM**: Code smell, lack of tests, minor improvement
- **LOW**: Style, naming, suggestion

Deliver as a table: | Priority | Axis | File:Line | Finding | Required Action |

## PHASE 4: ACTION PLAN
Generate an action plan organized into ordered sprints/work packages:
1. Quick wins (CRITICAL + easy)
2. Security and stability (CRITICAL/HIGH)
3. Functional bugs (HIGH)
4. Technical debt (MEDIUM)
5. Tests and coverage
6. Best practices and polish (LOW)

Each item must include: file, specific change, estimated effort (minutes).

## PHASE 5: EXECUTION
After my approval of the plan, make the changes:
- Fix critical and high-priority bugs
- Apply security patches (OWASP)
- Fix configurations
- Add missing tests
- Each change must be atomic and explained

## RULES
- Make NO assumptions: read the actual code; do not invent findings
- If a finding requires human confirmation, mark it with `[?]`
- Use exact file:line references for every finding
- If the project is very large (>50 files), prioritize core files
- At the end, provide a 3-line executive summary: overall status, main risks, recommended next action