GDG Buildathon RUSL 26'

Perform a comprehensive audit of this entire codebase.

Your job is to inspect the project end-to-end and identify issues across architecture, security, performance, maintainability, reliability, developer experience, and production readiness.

Do not only review individual files. Understand how the whole system works together.

Audit the following areas:

1. Architecture
- Understand the overall application structure.
- Identify major modules, services, routes, components, APIs, database layers, background jobs, and external integrations.
- Check whether responsibilities are properly separated.
- Find duplicated logic, tightly coupled modules, circular dependencies, poor abstractions, or unnecessary complexity.
- Flag architecture decisions that may become difficult to scale or maintain.

2. Security
- Look for exposed secrets, API keys, tokens, credentials, or sensitive environment variables.
- Check authentication and authorization flows.
- Check whether protected routes and API endpoints are actually protected.
- Look for IDOR, privilege escalation, insecure direct object access, broken access control, injection risks, XSS, CSRF, SSRF, insecure redirects, unsafe file uploads, path traversal, command injection, SQL injection, and insecure deserialization.
- Review password, session, cookie, JWT, OAuth, and token handling where applicable.
- Check rate limiting and abuse protection.
- Review CORS and security headers.
- Check logging for accidental exposure of sensitive information.
- Review third-party integrations for unsafe assumptions.
- Identify dependency or supply-chain risks where visible from the repository.

3. Database and Data Layer
- Review schema design, migrations, indexes, relationships, constraints, and data types.
- Find inefficient queries, N+1 queries, unnecessary round trips, missing indexes, and overly expensive queries.
- Check transaction handling and race conditions.
- Check whether validation exists before data reaches the database.
- Look for inconsistent data models and duplicated sources of truth.
- Review deletion behavior, cascading rules, orphaned records, and data retention logic.
- Check for unsafe raw SQL.
- If the project uses Neon/Postgres, specifically review connection handling, pooling, serverless compatibility, migrations, query performance, and environment configuration.

4. File and Image Handling
- Review all upload, download, storage, image, and media logic.
- Check file size limits, MIME/type validation, filename sanitization, access control, and malicious upload risks.
- Determine whether files are being stored in the correct place.
- If Cloudinary, Vercel Blob, S3, or similar storage is used, check whether the integration follows good practices.
- Check whether database storage contains only appropriate metadata instead of unnecessarily storing large binary files.
- Review image optimization, resizing, compression, caching, CDN usage, and responsive image handling.
- Look for orphaned uploaded files when database records are deleted.
- Check signed uploads or private assets where needed.

5. Backend and API
- Audit every API route, server action, RPC endpoint, webhook, middleware, and backend service.
- Check validation for every external input.
- Check authentication and authorization on every sensitive operation.
- Ensure correct HTTP status codes and error responses.
- Find inconsistent API shapes.
- Check pagination, filtering, sorting, and limits.
- Review webhook verification and idempotency.
- Look for race conditions and duplicate processing.
- Check retry behavior and timeout handling for external APIs.

6. Frontend
- Review components, hooks, state management, forms, routing, and data fetching.
- Identify unnecessary re-renders, excessive client-side code, oversized components, duplicated UI logic, and poor state boundaries.
- Check loading, empty, error, and success states.
- Check form validation and submission behavior.
- Look for hydration issues or client/server mismatches.
- Check image and asset loading.
- Review accessibility: semantic HTML, keyboard navigation, labels, focus states, ARIA usage, contrast assumptions, and screen-reader behavior.
- Review responsive behavior where identifiable from the code.

7. Next.js / React
If this is a Next.js project:
- Review App Router / Pages Router usage.
- Check Server Components vs Client Components.
- Flag unnecessary "use client" usage.
- Check server actions for authorization and validation.
- Check route handlers and middleware.
- Review caching, revalidation, dynamic rendering, static rendering, and fetch behavior.
- Identify possible hydration problems.
- Review metadata, SEO, sitemap, robots, Open Graph, and structured data.
- Check next/image usage and remote image configuration.
- Look for unnecessarily large bundles.
- Check whether sensitive server-only code can leak into client bundles.

8. Performance
- Identify slow paths and unnecessary work.
- Review database queries, external API calls, rendering, caching, image loading, bundle size, and network waterfalls.
- Find sequential calls that could safely run in parallel.
- Check for repeated fetches or duplicate queries.
- Review caching opportunities.
- Look for memory leaks or unbounded data growth.
- Identify endpoints or pages that may degrade under load.

9. Error Handling and Reliability
- Find swallowed errors or overly broad catch blocks.
- Check whether errors are logged with enough context.
- Check whether sensitive information can leak through errors.
- Review retry policies.
- Identify operations that are not idempotent but should be.
- Check failure behavior for database outages, API failures, upload failures, and partial transactions.
- Look for race conditions and concurrency issues.

10. Validation and Type Safety
- Check TypeScript quality.
- Find excessive use of any, unknown casts, unsafe assertions, @ts-ignore, or non-null assertions.
- Identify inconsistent types between frontend, API, and database.
- Review schema validation libraries such as Zod, Yup, Joi, Valibot, etc.
- Ensure server-side validation exists even if client-side validation is present.
- Look for duplicated schemas that may drift apart.

11. Dependencies
- Review package.json and lock files.
- Identify unused, duplicated, outdated, risky, or unnecessary dependencies.
- Look for libraries that significantly increase bundle size.
- Flag packages being used for functionality already available natively.
- Identify dependency version inconsistencies.
- Do not automatically upgrade packages unless clearly justified.

12. Environment and Configuration
- Review .env usage and environment variable validation.
- Check separation between development, preview, staging, and production.
- Look for hardcoded URLs, IDs, credentials, ports, domains, or environment-specific assumptions.
- Check whether required environment variables fail safely when missing.
- Review deployment configuration such as Vercel configuration, Dockerfiles, CI/CD, build scripts, and runtime settings.

13. Testing
- Review existing unit, integration, end-to-end, and API tests.
- Identify critical paths that have no tests.
- Look for brittle tests, meaningless tests, or excessive mocking.
- Recommend the highest-value missing tests.
- Pay special attention to authentication, permissions, payments, uploads, destructive actions, and critical business logic.

14. Logging, Monitoring, and Observability
- Review logging practices.
- Identify console.log/debug statements that should not be in production.
- Check whether important failures are observable.
- Review error monitoring, analytics, tracing, and health checks where present.
- Recommend missing observability only when it provides real production value.

15. SEO and Web Quality
If this is a public-facing web application:
- Review page titles and metadata.
- Check canonical URLs.
- Review robots.txt and sitemap behavior.
- Check structured data where relevant.
- Look for duplicate content or missing metadata.
- Check performance-related SEO issues.
- Review public image alt text and semantic markup.

16. Code Quality
- Find dead code, unused files, unused exports, commented-out legacy code, duplicated utilities, and inconsistent naming.
- Identify functions or components that are too large.
- Check whether abstractions are helping or making the code harder to understand.
- Find magic values and hardcoded business rules.
- Review folder and file naming consistency.
- Identify places where code can be simplified without overengineering.

17. Business Logic
- Trace important user flows from beginning to end.
- Identify logical edge cases.
- Check whether business rules are enforced only in the UI instead of on the server.
- Look for ways users could bypass intended restrictions.
- Check ownership, tenancy, roles, quotas, limits, and lifecycle states.
- Identify inconsistent status transitions or impossible states.