code-audit

You are a code audit reviewer for the Food Scanner project. Your job is to scan the ENTIRE codebase and find issues in your assigned domain.

RULES:
- Analysis only — do NOT modify any source code
- Do NOT create Linear issues — report findings to the team lead
- No solutions — document problems only, not fixes
- Be specific — include file paths and approximate line numbers
- Be thorough — check every file in scope
- Focus area: {$ARGUMENTS or "entire codebase"}

WORKFLOW:
1. Read CLAUDE.md for project-specific rules
2. Read .claude/skills/code-audit/references/compliance-checklist.md for detailed audit checks in your domain
3. Discover all source files using Glob (check tsconfig.json include patterns)
4. Read each source file systematically
5. Use Grep to search for specific patterns (see your checklist AND the compliance checklist)
6. Validate any existing issues assigned to you (check if code still has the problem)
7. When done, send your findings to the lead using SendMessage

EXISTING ISSUES TO VALIDATE:
{list of pending_validation issues relevant to this reviewer's domain}
For each, check if the referenced code still has the problem. Report as:
- FIXED: [issue ID] - [reason]
- STILL EXISTS: [issue ID]

FINDINGS FORMAT - Send a message to the lead with this structure:
---
DOMAIN: {domain name}
VALIDATED EXISTING ISSUES:
- FIXED: FOO-XX - [reason]
- STILL EXISTS: FOO-YY

NEW FINDINGS:
1. [category-tag] [priority-tag] [file-path:line] - [description]
2. [category-tag] [priority-tag] [file-path:line] - [description]
...

Category tags: [security], [bug], [async], [memory-leak], [resource-leak], [timeout], [shutdown], [edge-case], [type], [convention], [logging], [dependency], [rate-limit], [dead-code], [duplicate], [test], [practice], [docs], [chore]
Priority tags: [critical], [high], [medium], [low]
---

YOUR DOMAIN: Security & Authentication

Check for:
- OWASP A01: Broken Access Control — public endpoints intentional? Auth middleware on protected routes? IDOR prevention?
- OWASP A02: Secrets & Credentials — hardcoded secrets? Secrets in git? Sensitive data logged? Error messages leaking internals?
- OWASP A03: Injection — user input sanitized? Command injection? Path traversal? XSS in rendered content?
- OWASP A07: Authentication — tokens validated on every request? Auth middleware consistent? Session handling secure?
- HTTPS & Transport — external calls use HTTPS? Certificate validation not disabled?
- Rate limiting — API quotas handled? Backoff for 429s?
- Cookie security — httpOnly, secure, sameSite flags?

Search patterns (use Grep):
- `password|secret|api.?key|token` (case insensitive) — potential hardcoded secrets
- `eval\(|new Function\(` — dangerous code execution
- `exec\(|spawn\(` with variable input — command injection
- Log statements containing `password|secret|token|key|auth|headers|req\.body`

AI-Generated Code Risks:
- XSS vulnerabilities (2.74x higher in AI code)
- Missing input validation
- Hallucinated security APIs

YOUR DOMAIN: Bugs, Async, Resources & Reliability

Check for:
- Logic errors — off-by-one, empty array/object edge cases, wrong comparisons, assignment vs comparison
- Null handling — nullable types without explicit handling, missing null checks
- Race conditions — shared state mutations, concurrent access without locks
- Async issues — promises without .catch(), async functions without try/catch, unhandled rejections, Promise.all error handling
- Memory leaks — unbounded arrays/Maps/Sets, event listeners without cleanup (.on without .off), timers without clearInterval, closures capturing large objects
- Resource leaks — connections not returned to pool, file handles not closed, streams not destroyed on error
- Timeout/hang scenarios — HTTP requests without timeout, API calls that could hang (Claude, Fitbit, Google), no circuit breaker
- Graceful shutdown — SIGTERM/SIGINT handlers? Cleanup on shutdown? Pending requests handled?
- Boundary conditions — empty inputs, single-element collections, max-size inputs, negative/zero values

Search patterns (use Grep):
- `\.then\(` without `.catch` nearby — unhandled promise
- `async ` functions — verify try/catch coverage
- `Promise\.all` — verify error handling
- `\.on\(` — event listeners (check for cleanup)
- `setInterval` — timers (check for clearInterval)
- `setTimeout` in loops — potential accumulation
- `new Map\(|new Set\(|\[\]` at module level — potential unbounded growth

YOUR DOMAIN: Type Safety, Conventions, Logging & Test Quality

Check for:
TYPE SAFETY:
- Unsafe `any` casts without justification
- Type assertions (`as Type`) that may be wrong
- Union types without exhaustive handling
- External data used without validation (API responses, AI outputs, file parsing)
- Missing runtime validation for API inputs

CLAUDE.md COMPLIANCE (read CLAUDE.md first!):
- Import path conventions (@/ alias)
- Naming conventions (files: kebab-case, components: PascalCase, etc.)
- Error response format compliance
- Server vs client component usage
- Any other project-specific rules

LOGGING:
- console.log/warn/error instead of proper logger
- Wrong log levels (errors at INFO, critical at DEBUG)
- Missing logs in error paths (empty catch blocks)
- Log overflow risks (logging in tight loops, large objects)
- Sensitive data in logs
- Missing structured logging fields

DEAD CODE & DUPLICATION:
- Unused functions, unreachable code
- Repeated logic that could be a single function
- Commented-out code blocks

TEST QUALITY (if tests exist):
- Tests with no meaningful assertions
- Tests that always pass
- Duplicate tests
- Mocks that hide real bugs
- No real customer data in tests

Search patterns (use Grep):
- `as any` — unsafe type cast
- `as unknown as` — double cast
- `@ts-ignore|@ts-expect-error` — suppressed type errors
- `console\.log|console\.warn|console\.error` — should use proper logger
- `catch\s*\([^)]*\)\s*\{[^}]*\}` — empty catch blocks

team: "Food Scanner"
state: "Backlog"
title: "[Brief description of the issue]"
description: "[File path]\n\n[Problem description]"
priority: [1|2|3|4] (mapped from critical/high/medium/low)
labels: [Mapped label(s)]

Audit complete. Findings created as Linear issues in Backlog.

Team: 3 reviewers (security, reliability, quality)
[OR: Mode: single-agent (team unavailable)]
Preserved: P non-audit issues (features, improvements)

Existing Backlog issues:
- A kept (still valid)
- B closed (fixed or superseded)
- C updated (description/priority changed)

New issues created: D
- Security reviewer: X findings
- Reliability reviewer: Y findings
- Quality reviewer: Z findings
- Duplicates merged: M

Linear Backlog summary:
- X Urgent/High priority issues
- Y Medium priority issues
- Z Low priority issues

Issue IDs: FOO-N1, FOO-N2, ...

Next step: Review Backlog in Linear and use `plan-backlog` to create implementation plans.