Sample Audit Reports

Current code:

// src/pages/dashboard.tsx - No cleanup on unmount
useEffect(() => {
  const ws = new WebSocket('wss://api.example.com/orders');

  ws.onmessage = (event) => {
    setOrders(prev => [...prev, JSON.parse(event.data)]);
  };

  ws.onerror = (err) => {
    console.error('WebSocket error:', err);
  };

  // Missing return cleanup!
}, []);

Recommended fix:

useEffect(() => {
  const ws = new WebSocket('wss://api.example.com/orders');

  ws.onmessage = (event) => {
    setOrders(prev => [...prev, JSON.parse(event.data)]);
  };

  ws.onerror = (err) => {
    console.error('WebSocket error:', err);
  };

  return () => {
    ws.close();
  };
}, []);

Current code:

// src/App.tsx - No error boundary
function App() {
  return (
    <Router>
      <Routes>
        <Route path="/" element={<Home />} />
        <Route path="/products" element={<Products />} />
        <Route path="/checkout" element={<Checkout />} />
      </Routes>
    </Router>
  );
}

Recommended fix:

// src/components/ErrorBoundary.tsx
'use client'
import { Component, ReactNode } from 'react'

interface Props { children: ReactNode; fallback?: ReactNode }
interface State { hasError: boolean }

class ErrorBoundary extends Component<Props, State> {
  state: State = { hasError: false }

  static getDerivedStateFromError(): State {
    return { hasError: true }
  }

  componentDidCatch(error: Error, info: React.ErrorInfo) {
    console.error('ErrorBoundary caught:', error, info)
  }

  render() {
    if (this.state.hasError) {
      return this.props.fallback || <FallbackErrorPage />
    }
    return this.props.children
  }
}

// src/App.tsx - With error boundary
function App() {
  return (
    <ErrorBoundary>
      <Router>
        <Routes>
          <Route path="/" element={<Home />} />
          <Route path="/products" element={<Products />} />
          <Route path="/checkout" element={<Checkout />} />
        </Routes>
      </Router>
    </ErrorBoundary>
  );
}

Current code:

// src/config/app.ts
const config = {
  stripeKey: 'sk_live_51N8x2KLm4...',
  apiUrl: 'https://api.production.com',
  maxRetries: 5,
};

Recommended fix:

// src/config/app.ts
const config = {
  stripePublishableKey: process.env.NEXT_PUBLIC_STRIPE_KEY,
  apiUrl: process.env.NEXT_PUBLIC_API_URL,
  maxRetries: parseInt(process.env.MAX_RETRIES || '3'),
};

// .env.local (never committed)
// NEXT_PUBLIC_STRIPE_KEY=pk_live_...
// STRIPE_SECRET_KEY=sk_live_...  (server-side only)
// NEXT_PUBLIC_API_URL=https://api.production.com

Current code:

// src/routes/users.ts - Direct string interpolation in SQL
app.get('/api/users/search', async (req, res) => {
  const { q } = req.query;

  const users = await db.query(
    `SELECT * FROM users WHERE name LIKE '%${q}%'`
  );

  res.json(users);
});

// Attack: /api/users/search?q=' UNION SELECT username,password FROM users--

Recommended fix:

app.get('/api/users/search', async (req, res) => {
  const { q } = req.query;

  const users = await db.query(
    'SELECT * FROM users WHERE name LIKE $1',
    [`%${q}%`]
  );

  res.json(users);
});

Current code:

// src/routes/admin/users.ts - No auth check
export default async function handler(req, res) {
  const users = await db.query('SELECT * FROM users');
  const orders = await db.query('SELECT * FROM orders');

  res.json({ users, orders });
}

Recommended fix:

import { withAuth } from '@/lib/auth-middleware';

export default withAuth(async function handler(req, res) {
  if (req.user.role !== 'admin') {
    return res.status(403).json({ error: 'Forbidden' });
  }

  const users = await db.query('SELECT id, name, email FROM users');
  res.json({ users });
}, { role: 'admin' });

Current code:

// src/lib/data.ts - 51 database queries!
async function getDashboardData() {
  const users = await db.query('SELECT * FROM users LIMIT 50');

  const dashboardData = [];
  for (const user of users) {
    const orders = await db.query(
      'SELECT * FROM orders WHERE user_id = $1',
      [user.id]
    );
    dashboardData.push({ user, orders });
  }

  return dashboardData; // 1 + 50 = 51 queries
}

Recommended fix:

// Option 1: Single JOIN query
async function getDashboardData() {
  const data = await db.query(`
    SELECT u.*, json_agg(o.*) as orders
    FROM users u
    LEFT JOIN orders o ON u.id = o.user_id
    GROUP BY u.id
    LIMIT 50
  `);
  return data;
}

// Option 2: Prisma eager loading
const users = await prisma.user.findMany({
  take: 50,
  include: { orders: true }
});

Current code:

-- No indexes on foreign keys
CREATE TABLE orders (
  id SERIAL PRIMARY KEY,
  user_id INTEGER NOT NULL,   -- No index!
  product_id INTEGER NOT NULL, -- No index!
  amount DECIMAL(10,2),
  created_at TIMESTAMP
);

-- This scans ALL 100,000 rows every time:
SELECT * FROM orders WHERE user_id = 123;
-- EXPLAIN: Seq Scan on orders (cost=0.00..15000.00)

Recommended fix:

-- Add indexes on frequently queried columns
CREATE INDEX idx_orders_user_id ON orders(user_id);
CREATE INDEX idx_orders_product_id ON orders(product_id);
CREATE INDEX idx_orders_created_at ON orders(created_at);

-- Composite index for common dashboard query
CREATE INDEX idx_orders_user_created
  ON orders(user_id, created_at DESC);

-- Now uses index scan:
SELECT * FROM orders WHERE user_id = 123;
-- EXPLAIN: Index Scan using idx_orders_user_id (cost=0.29..8.31)