Source code
Code quality
Stability
Releases
Security & compliance
Engineering practices
Whether anything would catch a regression before your users do.
Overview
A read of the safety net around your code: test coverage where it counts, TypeScript strictness, and whether CI actually blocks a bad merge. Findings here are graded on what the module does, not on a coverage percentage.
What it looks for
- No automated tests, or none covering auth, payments, and data access
- TypeScript strict mode off
- any, non-null assertions, and @ts-ignore applied to external input
- CI with no test, typecheck, or lint gate
- Large untested core modules, and missing README or runbook docs
Why it matters
An untested payments or auth module is the one place a silent regression is expensive. A CI pipeline with no test gate is a pipeline that will merge the regression on a Friday.
Rules in this check
| What it reports | Fix path |
|---|---|
| No automated tests in an app repo | Guide |
| Critical module (auth/payments/data) untested | Guide |
| TypeScript strict mode is off — whole classes of bugs go undetected | Guide |
| Unsafe type escapes on external input | Guide |
| No CI test/typecheck/lint gate | Guide |
| Missing README / runbook docs | Guide |
| Oversized untested core module | Guide |
How the fixes arrive
GuideChanges only you can make safely arrive as a step-by-step guide you can follow yourself or hand to your coding agent.
Run them all on your app
Connect your repo and your live services with read-only scopes. The first scan is free, and nothing changes without your approval.