acme-web: where you're at
Acme Logistics · Reviewed 12 Oct 2026 · Commit 4f2a9c1 · TypeScript, React 18, Express 4, Node 18 · ~180k lines · Setup: me + AI tools, on my side
Works on prod, but it's getting expensive to change.
The core booking flow is solid and reasonably tested. Most of the debt sits in authentication, an outdated dependency tree and three competing ways of fetching data. Nothing here needs a rewrite. Two security items should be fixed this sprint.
Score breakdown
Scores combine automated checks (qoq, npm audit, type coverage, test coverage) with my reading of the code. 0–39 at risk · 40–59 fair · 60–79 healthy · 80+ strong.
Headline risks
- CriticalSession token readable from JavaScript · SecurityThe auth token is stored in localStorage, so any XSS gives full account takeover. Move it to an httpOnly, SameSite cookie.
src/lib/auth/session.ts - CriticalAdmin API route skips the role check · SecurityOne route in the admin API checks that a user is logged in but not that they are an admin.
src/server/routes/admin/export.ts - HighKnown vulnerabilities in direct dependencies · Dependencies3 high-severity advisories (axios, semver, a markdown parser). All have patched versions available.
package.json - MediumThree ways to fetch data · ConsistencySWR, React Query and hand-rolled fetch hooks live side by side, so caching and error handling differ per screen.
src/hooks, src/features/*
Quick wins
| Change | Effort | Payoff |
|---|---|---|
| Patch the 3 vulnerable packages. Patch-level bumps, no API changes expected. | XS | High |
| Add the missing role check. One line plus a test. | XS | High |
| Remove 9 unused dependencies. Smaller installs, fewer advisories to track. | S | Medium |
| Turn on lint rules qoq already flags. Stops new inconsistencies landing while you fix old ones. | M | Medium |
| Pick one data-fetching library for new code. Write it down; migrate old screens when you touch them. | S | Medium |
Effort: XS under 2 hours · S up to a day · M a few days · L about a week · XL more than a week.
What this report doesn't cover
A brief look is a sample, not a full read. I didn't review infrastructure, CI/CD configuration or runtime behaviour, and I didn't run the app. Scores reflect the code at commit 4f2a9c1. This is a professional opinion, not a security certification.
Possible next steps
The quick wins above are yours to take, with no strings attached. If you want the full picture:
Full audit · €250
Detailed findings, critical fixes, infrastructure constraints, and a prioritized plan with a scoped proposal for next steps.
Hands-on · €50/h
I do the fixes, or advise your team: ticket planning, sprint support, reviews. Prepaid blocks on a weekly schedule.
Prices in EUR, excl. VAT. See the sample full audit →
Confidential, for Acme Logistics only · Agreement no. 2026/014