acme-web: full audit and remediation plan
Acme Logistics · Delivered 19 Oct 2026 · Commit 4f2a9c1 · TypeScript, React 18, Express 4, Node 18 · ~180k lines · Setup: me + AI tools, on my side · ~5 hours
No rewrite needed. Fix auth this week, then pay down debt in three phases.
The booking core is solid. Risk concentrates in authentication, a dependency tree that has drifted for two years, and inconsistent data access that makes every feature slower to build. The plan below gets you to "healthy" in about 12 weeks alongside normal feature work, at roughly 20% of team capacity.
1. Score breakdown
The tick on each bar marks the 12-week target. 0–39 at risk · 40–59 fair · 60–79 healthy · 80+ strong. Effort: XS under 2 hours · S up to a day · M a few days · L about a week · XL more than a week.
2. Critical fixes
Fix before anything else. Each one is exploitable or can cause data loss today.
C1 · Session token readable from JavaScript
Effort M- Evidence
- JWT stored in localStorage in src/lib/auth/session.ts and read on every request.
- Impact
- Any XSS, including from a third-party script, gives full account takeover.
- Fix
- Move to httpOnly, Secure, SameSite=Lax cookies; add CSRF protection to mutating routes; rotate existing tokens.
C2 · Admin export route skips the role check
Effort XS- Evidence
- src/server/routes/admin/export.ts calls requireSession() but not requireRole("admin").
- Impact
- Any logged-in customer can download the full shipment export.
- Fix
- Add the role check, add a test, and check access logs for past calls from non-admins.
C3 · Database migrations run on app start
Effort S- Evidence
- server.ts runs prisma migrate deploy before listening; two replicas start in parallel.
- Impact
- Concurrent deploys can apply a migration twice or leave the schema half-migrated.
- Fix
- Run migrations as a single CI step before rollout; fail the deploy if it fails.
3. Detailed findings
| ID | Severity | Finding and recommendation | Effort |
|---|---|---|---|
| S1 | High | Vulnerable direct dependencies. 3 high-severity advisories (axios, semver, markdown parser); all patchable. package.json | XS |
| S2 | Medium | No rate limiting on login and password reset. Add per-IP and per-account limits at the edge. src/server/routes/auth/* | S |
| D1 | High | React 18 → 19 and Express 4 → 5 overdue. Blocks security patches and newer libraries. Upgrade in two steps behind the test suite. | L |
| D2 | Medium | 9 unused and 4 duplicate packages. Remove; dedupe date libraries to one. | S |
| T1 | High | Auth and payments under 30% test coverage. Add integration tests for login, refresh, checkout and refund before touching C1. src/features/auth, payments | M |
| A1 | Medium | Three ways to fetch data. Standardise on React Query; wrap fetch in one client with shared error handling. src/hooks, src/features/* | L |
| A2 | Medium | Redux and Zustand side by side. Keep Zustand for UI state; move server state to React Query; retire Redux slice by slice. | L |
| M1 | Low | Four hot-spot files over 1,200 lines. Split along existing feature boundaries when next touched. BookingForm.tsx, +3 | M |
| P1 | Low | CI takes 18 minutes. Cache dependencies, shard tests, run lint and types in parallel. Target under 8 minutes. .github/workflows/ci.yml | S |
4. Infrastructure constraints
Limits outside the code that shape the plan. Reviewed from config and documentation only, not live systems.
- Hosting
- Two containers on a single managed Kubernetes cluster, one region. No staging parity: staging uses SQLite.
- Database
- Managed Postgres 13, end of support Nov 2025. Upgrade path to 16 is straightforward but needs a maintenance window.
- Secrets
- Injected as env vars from the CI provider. Two long-lived API keys have no rotation process.
- Observability
- Error tracking in place; no tracing or structured logs, so incidents are diagnosed by guesswork.
5. Remediation plan
Ordered by risk first, then by how much each step unblocks the next. Phases overlap with feature work; nothing here needs a feature freeze.
Phase 0 · Stop the bleeding
This week · ~3 dev-days- Add the admin role check and audit past access.
C2XS - Patch vulnerable dependencies.
S1XS - Move migrations out of app start into a CI step.
C3S - Rotate the two long-lived API keys.
InfraXS
Done when: No critical findings left except C1; deploys are safe to run in parallel.
Phase 1 · Secure auth
Weeks 1–4 · ~2 dev-weeks- Integration tests for login, refresh, checkout, refund.
T1M - Move sessions to httpOnly cookies with CSRF protection.
C1M - Rate limits on login and reset.
S2S - Remove unused and duplicate packages.
D2S
Done when: Security score 70+; auth covered by tests that run on every PR.
Phase 2 · Upgrade the platform
Weeks 4–8 · ~2 dev-weeks- React 18 → 19, then Express 4 → 5, one step per release.
D1L - Postgres 13 → 16 with a planned maintenance window.
InfraS - Speed up CI to under 8 minutes.
P1S
Done when: All packages within one major version; database on a supported release.
Phase 3 · Make it consistent
Weeks 6–12 · ongoing, ~20% capacity- One data-fetching client; migrate screens as they are touched.
A1L - Retire Redux slice by slice.
A2L - Lint rules from qoq that block new inconsistencies.
A1, A2S - Split hot-spot files when next changed.
M1M
Done when: Overall score 75+; new code follows one pattern, enforced in CI.
6. Proposal for next steps
This report tells you exactly what to fix. You decide whether to do it with your team, with me, or both. Estimates are mine, based on the plan above.
Your team does it
Free follow-up call to walk through the plan. Questions by email for 30 days.
I advise your team
Ticket planning, sprint support, reviews. ~4 h/week for 12 weeks · 48 h
€2,400I do phases 0–1
Critical fixes, dependency upgrades, auth rework. ~40 h
€2,000€50/h, billed in full hours, as prepaid blocks on an agreed weekly schedule. Lower rate if we work in your own AI infrastructure. Prices in EUR, excl. VAT.
7. Scope and limits
Covered: application source, package.json and lockfile, CI config, Dockerfile, infrastructure-as-code in the repo, README and ADRs.
Not covered: live systems, penetration testing, load testing, third-party services beyond their integration code. This is a professional opinion based on commit 4f2a9c1, not a security certification.
Confidential, for Acme Logistics only · Agreement no. 2026/014