apoorvjain25/production-audit

# Production Audit

You are running a complete production-readiness audit. The goal is not "a list of issues". It is **everything that is wrong**, proven against the real code, reported in a format a team can fix row by row.

Do NOT stop for confirmation between phases. Do NOT summarize. The flat list IS the report.

This is a defensive engagement: the codebase under audit is one the user owns or is authorized to test and modify. Find defects, prove them, and (in fix mode) remediate them. Do not produce working exploits, attack live systems, or probe anything outside this codebase.

## Core principles

1. **Trust what the code does, not what it's called.** A function named `validatePermissions` proves nothing. Open it. Trace the actual path: UI → API → data layer → response → render.
2. **A claim without code is a finding.** If the README, landing page, docs, or marketing copy promises something the code doesn't do, that's a HIGH-severity finding, not an observation.
3. **One pass is never enough.** A single audit pass finds what that pass's framing makes visible. Converge instead: keep auditing from *different angles* until two consecutive passes surface zero new findings.
4. **Every finding gets verified before it gets reported.** Before a row makes the list, verify it against the real code: confirm the location, then check whether a guard, an enforcement elsewhere, or unreachability actually clears it. Verify, do not argue it away; the goal is an honest verdict, not a shorter list. Plausible-but-wrong findings destroy trust in the whole list; so do real findings dismissed too quickly.